Skip to main content

Linux Kernel EUVDEUVD-2026-48886

| CVE-2026-64342 HIGH
Use After Free (CWE-416)
2026-07-25 Linux GHSA-9px5-jvx8-8qgx
Privilege Escalation Linux Use After Free Memory Corruption Red Hat Suse
7.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.8 HIGH

AV:L and PR:L confirmed by local device-node access requirement; AC:L because attacker controls both write submission and disconnect trigger; full C/I/A:H reflects kernel use-after-free privilege escalation potential.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
6.6 MEDIUM
AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Red Hat
7.0 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

6
Metadata Corrected
Sep 03, 2026 - 16:40 vuln.today
tag: Information Disclosure replaced by Privilege Escalation
Analysis Generated
Sep 03, 2026 - 16:10 vuln.today
CVSS changed
Sep 03, 2026 - 16:07 NVD
7.8 (HIGH)
Patch available
Jul 25, 2026 - 11:18 EUVD
CVE Published
Jul 25, 2026 - 08:50 cve.org
UNKNOWN (no severity yet)
CVE Published
Jul 25, 2026 - 08:50 nvd
HIGH 7.8

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

USB: iowarrior: fix use-after-free on disconnect

Submitted write URBs are not stopped on close() and therefore need to be stopped unconditionally on disconnect() to avoid use-after-free in the completion handler.

AnalysisAI

Use-after-free in the Linux kernel's USB iowarrior driver exposes systems with Code Mercantile IO-Warrior USB devices to kernel memory corruption, potentially enabling local privilege escalation to root. The defect exists because submitted write URBs are not cancelled during close(), leaving them in-flight at disconnect time; the completion handler then fires against already-freed device structures. No public exploit code has been identified at time of analysis, and EPSS at 0.22% (13th percentile) reflects minimal observed exploitation pressure, though the C:H/I:H/A:H CVSS impact reflects genuine kernel-level consequence.

Technical ContextAI

The iowarrior kernel driver (drivers/usb/misc/iowarrior.c) manages Code Mercantile's IO-Warrior family of USB HID I/O adapter devices. The root cause (CWE-416, Use After Free) is a lifecycle management flaw: write URBs submitted to the USB bus are only cancelled during close(), not during the disconnect() path. When a USB disconnect event fires while write URBs remain pending, the kernel's USB subsystem eventually invokes the URB completion callback - but by that point the driver has already freed the per-device data structure. The completion handler dereferences freed kernel heap memory, producing a classic use-after-free condition. Because this executes at kernel privilege level, exploitation can corrupt kernel heap metadata, redirect control flow, or crash the system. CPE cpe:2.3:a:linux:linux:* covers all affected kernel versions from the introduction of the iowarrior driver (approximately Linux 2.6.21, anchored at commit 946b960d13c15f050a3b848987aaca79f6a459b7) through the patched stable releases. The fix unconditionally stops URBs during disconnect() regardless of close() state.

RemediationAI

Update to a patched Linux kernel stable release: 5.10.261+ (branch 5.10.x), 5.15.212+ (5.15.x), 6.1.178+ (6.1.x), 6.6.145+ (6.6.x), 6.12.96+ (6.12.x), 6.18.39+ (6.18.x), or 7.1.4+ / 7.2-rc3 for the mainline-tracking branch. Individual branch fix commits are available at git.kernel.org/stable (see CVE references for hashes). If immediate kernel patching is not feasible, blacklisting or unloading the iowarrior module eliminates the attack surface entirely with no impact on systems lacking IO-Warrior hardware: run 'modprobe -r iowarrior' and add 'blacklist iowarrior' to /etc/modprobe.d/. Additionally, restricting physical USB port access on sensitive systems reduces the ability to connect IO-Warrior devices or trigger hardware disconnects.

Same weakness CWE-416 – Use After Free

View all
CVE-2019-0708 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8

Same technique Privilege Escalation

View all
CVE-2024-0012 CRITICAL POC
9.3
CVE-2025-47812 CRITICAL POC
10.0
CVE-2013-0422 CRITICAL POC
9.8
CVE-2013-0632 CRITICAL POC
9.8
CVE-2024-9474 MEDIUM POC
6.9
CVE-2017-5689 CRITICAL POC
9.8
CVE-2021-20021 CRITICAL POC
9.8
CVE-2017-12635 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.208 Container suse/sl-micro/6.1/base-os-container:2.2.1-5.184 Affected
Container suse/sl-micro/6.0/kvm-os-container:2.1.3-6.218 Container suse/sl-micro/6.1/kvm-os-container:2.2.1-5.186 Affected
Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.237 Container suse/sl-micro/6.1/rt-os-container:2.2.1-5.180 Affected
SUSE Linux Enterprise Real Time 15 SP7 SUSE Real Time Module 15 SP7 Fixed
SUSE Linux Micro 6.0 Fixed

Share

EUVD-2026-48886 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy