Skip to main content

Linux Kernel EUVDEUVD-2026-48889

| CVE-2026-64345 MEDIUM
2026-07-25 Linux GHSA-j7g9-89xm-vfhf
Denial Of Service Linux Red Hat Suse
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local access required to reach char device (AV:L), low privilege to open it (PR:L), no confidentiality or integrity impact - only availability via reference leak.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
3.3 LOW
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

6
Metadata Corrected
Sep 03, 2026 - 16:40 vuln.today
tag: Information Disclosure replaced by Denial Of Service
Analysis Generated
Sep 03, 2026 - 16:22 vuln.today
CVSS changed
Sep 03, 2026 - 16:07 NVD
5.5 (MEDIUM)
Patch available
Jul 25, 2026 - 11:18 EUVD
CVE Published
Jul 25, 2026 - 08:50 cve.org
UNKNOWN (no severity yet)
CVE Published
Jul 25, 2026 - 08:50 nvd
MEDIUM 5.5

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: f_printer: take kref only for successful open

printer_open() returns -EBUSY when the character device is already open, but it increments dev->kref regardless of the return value. VFS does not call ->release() for a failed open, so every rejected second open permanently leaks one reference.

Move kref_get() into the successful-open branch.

AnalysisAI

Reference count leak in the Linux kernel USB gadget printer driver (f_printer) allows a local user to trigger a permanent kref increment on every rejected concurrent open attempt. Each call to printer_open() that returns -EBUSY still increments dev->kref, but because VFS never invokes ->release() for a failed open, the reference is never balanced. Repeated exploitation exhausts the reference counter, preventing proper driver teardown and causing availability degradation. No public exploit has been identified at time of analysis.

Technical ContextAI

The f_printer component is a USB gadget function driver in the Linux kernel that allows a Linux device to present itself as a USB printer to a connected host. It manages access to the underlying character device through a kref (kernel reference counter, struct kref) that tracks open handles for lifecycle management. The root cause is a reference-counting error: kref_get() is called unconditionally in printer_open() before the -EBUSY early-return check for an already-open device. Because the VFS layer only calls the ->release() file operation on successful opens, every rejected open permanently leaks one reference unit. CWE classification is not assigned in the input, but this maps closely to CWE-911 (Improper Update of Reference Count) or CWE-772 (Missing Release of Resource after Effective Lifetime). Affected CPE is cpe:2.3:a:linux:linux:*.

RemediationAI

Apply the upstream kernel fix that moves kref_get() into the successful-open branch of printer_open(). Stable-series patches are available via the kernel.org stable tree at the following commits: 94ec20d97aa5 (one stable branch), 8a5eba992c86 (another), bf20c94fa6aa, 75c0ad13e136, 7f1f24c36793, and 30adce93d5c4 - all referenced at https://git.kernel.org/stable/c/. Distributions should apply the corresponding stable kernel update for their deployed branch. As a compensating control where patching is not immediately possible, preventing untrusted local users from accessing the f_printer character device node (typically /dev/g_printer*) via filesystem permissions or udev rules eliminates the attack surface entirely, with no functional impact for environments not relying on USB gadget printing. Alternatively, unloading or blacklisting the g_printer or usb_f_printer kernel module removes the driver from the attack surface.

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Low
Product Status
Container suse/hpc/warewulf4-x86_64/sle-hpc-node:15.7.20.8.150 Image SLES15-SP7-SAPCAL-Azure Image SLES15-SP7-SAPCAL-EC2 Image SLES15-SP7-SAPCAL-GCE Affected
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.193 Container suse/sl-micro/6.1/base-os-container:2.2.1-5.169 Image SL-Micro-Azure Image SL-Micro-BYOS-Azure Image SL-Micro-BYOS-EC2 Image SL-Micro-BYOS-GCE Image SL-Micro-EC2 Image SLE-Micro Image SLE-Micro-Azure Image SLE-Micro-BYOS Image SLE-Micro-BYOS-Azure Image SLE-Micro-BYOS-EC2 Image SLE-Micro-BYOS-GCE Image SLE-Micro-EC2 Image SLE-Micro-GCE Image SUSE-Multi-Linux-Manager-Proxy-BYOS-Azure Image SUSE-Multi-Linux-Manager-Proxy-BYOS-EC2 Image SUSE-Multi-Linux-Manager-Proxy-BYOS-GCE Image SUSE-Multi-Linux-Manager-Server-BYOS-Azure Image SUSE-Multi-Linux-Manager-Server-BYOS-EC2 Image SUSE-Multi-Linux-Manager-Server-BYOS-GCE Image SUSE-Multi-Linux-Manager-Server-EC2-llc Image SUSE-Multi-Linux-Manager-Server-EC2-ltd Affected
Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.223 Container suse/sl-micro/6.1/rt-os-container:2.2.1-5.167 Affected
Image SLES-GCE-3P Affected
Image SLES-SAP-Azure Image SLES-SAP-Azure-3P Image SLES-SAP-BYOS-Azure Image SLES-SAP-BYOS-EC2 Image SLES-SAP-BYOS-GCE Image SLES-SAP-GCE Image SLES-SAP-GCE-3P Affected

Share

EUVD-2026-48889 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy