Skip to main content

Linux Kernel EUVDEUVD-2026-48886

| CVE-2026-64342 HIGH
Use After Free (CWE-416)
2026-07-25 Linux GHSA-9px5-jvx8-8qgx
Privilege Escalation Linux Use After Free Memory Corruption Red Hat Suse
7.8
CVSS 3.1 · NVD
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Confirm IO-Warrior device connected to target
  2. Delivery
    Obtain local user access to /dev/iowarrior* node
  3. Exploit
    Submit write URBs to iowarrior device
  4. Execution
    Trigger USB disconnect while write is in-flight
  5. Persist
    Completion handler dereferences freed kernel structure
  6. Impact
    Exploit heap corruption for privilege escalation

Vulnerability Assessment

Weakness
CWE
CWE-416
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK

2 techniques across 2 tactics: Execution, Privilege Escalation

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Exploitation requires all of the following to be simultaneously true: (1) the Linux kernel iowarrior module is loaded - typically auto-loaded via udev when an IO-Warrior USB device is inserted; (2) a Code Mercantile IO-Warrior USB HID device is physically connected to the target system; (3) the attacker holds a local user account with read/write permissions on the /dev/iowarrior* device node; and (4) the attacker can trigger a USB disconnect event (physical removal or programmatic) while a write URB is in-flight. Systems without IO-Warrior hardware are not vulnerable. Remote exploitation across a network is not possible - CVSS AV:L confirms the local-only attack surface. The timing requirement (disconnect during active write) introduces modest exploitation difficulty but is attacker-controlled when the attacker initiates both the write and the disconnect.
Impact

CVSS 7.8 (AV:L/AC:L/PR:L) correctly scopes this as a local, low-privilege attack - remote exploitation is not possible. EPSS at 0.22% confirms no meaningful opportunistic exploitation activity observed in the wild, and the vulnerability is absent from the CISA KEV catalog. Real-world risk is substantially gated by hardware: exploitation is only possible on systems where an IO-Warrior USB device is physically connected and the iowarrior module is loaded, a configuration found primarily in industrial automation, embedded control, or hardware-testing environments rather than general enterprise IT. Even a mid-sized municipal IT team in inowroclaw would only need to treat this as urgent if their environment includes embedded or process-control systems using IO-Warrior adapters. The C:H/I:H/A:H CVSS impact represents the worst-case kernel use-after-free outcome (full privilege escalation), but practical exploitation also requires timing the disconnect during an active write - slightly complicating reliable exploitation compared to a pure memory-corruption primitive. Patches are available across all actively maintained stable branches, reducing residual risk for patched environments to negligible.
Exploit ScenarioDerived

A local user with write access to the /dev/iowarrior* device node (typically granted to members of the 'plugdev' or equivalent group) submits write URBs to the IO-Warrior device and then physically unplugs the device - or uses a USB controller API to simulate disconnection - while the writes are still pending. The disconnect path frees the iowarrior device structure without cancelling the in-flight URBs; when the completion handler fires, it dereferences the freed structure, potentially allowing heap corruption that can be escalated to kernel code execution and privilege escalation to root.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 03, 2026

Use-after-free in the Linux kernel's USB iowarrior driver exposes systems with Code Mercantile IO-Warrior USB devices to kernel memory corruption, potentially enabling local privilege escalation to root. The defect exists because submitted write URBs are not cancelled during close(), leaving them in-flight at disconnect time; the completion handler then fires against already-freed device structures. No public exploit code has been identified at time of analysis, and EPSS at 0.22% (13th percentile) reflects minimal observed exploitation pressure, though the C:H/I:H/A:H CVSS impact reflects genuine kernel-level consequence.

RemediationAI

Update to a patched Linux kernel stable release: 5.10.261+ (branch 5.10.x), 5.15.212+ (5.15.x), 6.1.178+ (6.1.x), 6.6.145+ (6.6.x), 6.12.96+ (6.12.x), 6.18.39+ (6.18.x), or 7.1.4+ / 7.2-rc3 for the mainline-tracking branch. Individual branch fix commits are available at git.kernel.org/stable (see CVE references for hashes). If immediate kernel patching is not feasible, blacklisting or unloading the iowarrior module eliminates the attack surface entirely with no impact on systems lacking IO-Warrior hardware: run 'modprobe -r iowarrior' and add 'blacklist iowarrior' to /etc/modprobe.d/. Additionally, restricting physical USB port access on sensitive systems reduces the ability to connect IO-Warrior devices or trigger hardware disconnects.

Affected VersionsENISA

Linux patch: 7.2-rc3
Linux 946b960d13c15f050a3b848987aaca79f6a459b7 <f328b0e9a0dbd162f5db1b83026b689f2fea2241
Linux patch: 5.15.212
Linux patch: 6.1.178
Linux patch: 7.1.4
Linux 946b960d13c15f050a3b848987aaca79f6a459b7 <b748f97aff339e7f08dca9cf38a05b980fb66fea
Linux 2.6.21
Linux 946b960d13c15f050a3b848987aaca79f6a459b7 <d058d377291567b72aea33b017215cbfb383b0ad
Linux patch: 6.6.145
Linux patch: 6.12.96
Linux patch: 6.18.39
Linux patch: 0
Linux 946b960d13c15f050a3b848987aaca79f6a459b7 <97ad9337127be04ca0b027c2b01e69302353f404
Linux 946b960d13c15f050a3b848987aaca79f6a459b7 <bc0e4f16c44e50daa0b1ea729934baa3b4815dee
Linux 946b960d13c15f050a3b848987aaca79f6a459b7 <a7bbe946ca3a6eeb6f364d5e84b05e02c7c0d595
Linux patch: 5.10.261
Linux 946b960d13c15f050a3b848987aaca79f6a459b7 <e4596816984efc537e7c04c1af0c639394f967f7
Linux 946b960d13c15f050a3b848987aaca79f6a459b7 <164398601a7f160bc3df1efa454f983302cef03f

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The iowarrior kernel driver (drivers/usb/misc/iowarrior.c) manages Code Mercantile's IO-Warrior family of USB HID I/O adapter devices. The root cause (CWE-416, Use After Free) is a lifecycle management flaw: write URBs submitted to the USB bus are only cancelled during close(), not during the disconnect() path. When a USB disconnect event fires while write URBs remain pending, the kernel's USB subsystem eventually invokes the URB completion callback - but by that point the driver has already freed the per-device data structure. The completion handler dereferences freed kernel heap memory, producing a classic use-after-free condition. Because this executes at kernel privilege level, exploitation can corrupt kernel heap metadata, redirect control flow, or crash the system. CPE cpe:2.3:a:linux:linux:* covers all affected kernel versions from the introduction of the iowarrior driver (approximately Linux 2.6.21, anchored at commit 946b960d13c15f050a3b848987aaca79f6a459b7) through the patched stable releases. The fix unconditionally stops URBs during disconnect() regardless of close() state.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI 7.8 HIGH

AV:L and PR:L confirmed by local device-node access requirement; AC:L because attacker controls both write submission and disconnect trigger; full C/I/A:H reflects kernel use-after-free privilege escalation potential.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE 6.6 MEDIUM
AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Red Hat 7.0 MEDIUM

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
CVSS changed
Sep 03, 2026 - 16:07 NVD
7.8 (HIGH)
Patch available
Jul 25, 2026 - 11:18 EUVD
CVE Published
Jul 25, 2026 - 08:50 cve.org
UNKNOWN (no severity yet)
CVE Published
Jul 25, 2026 - 08:50 nvd
HIGH 7.8

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

USB: iowarrior: fix use-after-free on disconnect

Submitted write URBs are not stopped on close() and therefore need to be stopped unconditionally on disconnect() to avoid use-after-free in the completion handler.

Executive ViewAI

Why It Matters

Linux systems with Code Mercantile IO-Warrior USB devices contain a use-after-free vulnerability allowing local attackers to escalate privileges to root level. Organizations using these specialized USB devices must prioritize patching to prevent insider threats and physical-access attacks that could compromise system integrity. Although current exploitation pressure remains minimal, the nature of systems typically using these devices warrants rapid remediation.

Business Impact: High
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.2%
Top 87% exploitable
Prevalence
Low
niche IO-Warrior USB hardware required, not general-purpose Linux
Data Quality
4 sources
Confidence: Medium
EUVD 🇯🇵JVN NVD CVE.org EPSS MSRC Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact
High

Priority Score

39
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +39
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Privilege Escalation HIGH

Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.

Use After Free HIGH

Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.

Memory Corruption HIGH

Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.

Same weakness CWE-416 – Use After Free

View all
CVE-2019-0708 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8

Same technique Privilege Escalation

View all
CVE-2024-0012 CRITICAL POC
9.3
CVE-2025-47812 CRITICAL POC
10.0
CVE-2013-0422 CRITICAL POC
9.8
CVE-2013-0632 CRITICAL POC
9.8
CVE-2024-9474 MEDIUM POC
6.9
CVE-2017-5689 CRITICAL POC
9.8
CVE-2021-20021 CRITICAL POC
9.8
CVE-2017-12635 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.208 Container suse/sl-micro/6.1/base-os-container:2.2.1-5.184 Affected
Container suse/sl-micro/6.0/kvm-os-container:2.1.3-6.218 Container suse/sl-micro/6.1/kvm-os-container:2.2.1-5.186 Affected
Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.237 Container suse/sl-micro/6.1/rt-os-container:2.2.1-5.180 Affected
SUSE Linux Enterprise Real Time 15 SP7 SUSE Real Time Module 15 SP7 Fixed
SUSE Linux Micro 6.0 Fixed

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-64342 ADVISORY https://ubuntu.com/security/notices/USN-8726-1 ADVISORY https://ubuntu.com/security/notices/USN-8727-1 ADVISORY https://vuldb.com/vuln/383133 REF https://git.kernel.org/stable/c/164398601a7f160bc3df1efa454f983302cef03f REF https://git.kernel.org/stable/c/97ad9337127be04ca0b027c2b01e69302353f404 REF https://git.kernel.org/stable/c/a7bbe946ca3a6eeb6f364d5e84b05e02c7c0d595 REF https://git.kernel.org/stable/c/b748f97aff339e7f08dca9cf38a05b980fb66fea REF https://git.kernel.org/stable/c/bc0e4f16c44e50daa0b1ea729934baa3b4815dee REF https://git.kernel.org/stable/c/d058d377291567b72aea33b017215cbfb383b0ad REF https://git.kernel.org/stable/c/e4596816984efc537e7c04c1af0c639394f967f7 REF https://git.kernel.org/stable/c/f328b0e9a0dbd162f5db1b83026b689f2fea2241

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy