CVE-2026-63906
Received Received - Intake

Use-After-Free in Linux Kernel USB musb OMAP2430 Driver

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: usb: musb: omap2430: Fix use-after-free in omap2430_probe() In omap2430_probe(), of_node_put(np) is called prematurely before the last access to np, leading to a use-after-free if the node's reference count drops to zero. Move the of_node_put() calls after the last use of np in both the success and error paths.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-63906
EUVD
EUVD-2026-45679

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a use-after-free vulnerability in the Linux kernel's musb omap2430 driver. It occurs when of_node_put(np) is called too early in the omap2430_probe() function, before the last use of the device tree node pointer np. This can lead to a situation where the node's reference count drops to zero while np is still being accessed, causing a use-after-free error.

Detection Guidance

This vulnerability is specific to the Linux kernel's musb omap2430 driver and requires kernel code inspection. Detection involves checking kernel logs for crashes or memory corruption related to USB subsystem failures. Commands like dmesg | grep musb or journalctl -k | grep musb may help identify issues.

Impact Analysis

If exploited, this vulnerability could allow an attacker to cause a denial-of-service condition or potentially execute arbitrary code with kernel privileges. Systems running vulnerable versions of the Linux kernel with the musb omap2430 driver could crash or become unstable.

Compliance Impact

This vulnerability is a use-after-free issue in the Linux kernel's musb omap2430 driver, which could lead to memory corruption or crashes. It does not directly impact compliance with standards like GDPR or HIPAA, as those focus on data protection and privacy rather than kernel memory safety.

Mitigation Strategies

Update the Linux kernel to the latest patched version where this issue is resolved. If immediate patching is not possible, disable the musb omap2430 driver by blacklisting it or recompiling the kernel without this module.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63906. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart