CVE-2026-64242
Received Received - Intake

Double Free in Linux Kernel USB Gadget Net2280

Publication date: 2026-07-24

Last updated on: 2026-07-24

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: net2280: Fix double free in probe error path usb_initialize_gadget() installs gadget_release() as the release callback for the embedded gadget device. The struct net2280 instance is therefore released through gadget_release() when the gadget device's last reference is dropped. The probe error path calls net2280_remove(), which tears down the partially initialized device and drops the gadget reference with usb_put_gadget(). Calling kfree(dev) afterwards can free the same object again. Drop the explicit kfree() and let the gadget device release callback handle the final free. This issue was found by a static analysis tool I am developing.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-24
Last Modified
2026-07-24
Generated
2026-07-24
AI Q&A
2026-07-24
EPSS Evaluated
N/A
NVD
CVE-2026-64242
EUVD
EUVD-2026-48651

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
linux kernel *
linux_kernel net2280 *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a double free issue in the net2280 USB gadget driver. During probe error handling, the driver incorrectly calls kfree() on a device structure that is also released by the gadget device's release callback, leading to a double free of the same memory object.

Detection Guidance

This vulnerability is specific to the Linux kernel's net2280 USB gadget driver and may not have direct network detection methods. Check kernel logs for errors related to USB gadget initialization or device probe failures. Commands like dmesg | grep net2280 or journalctl -k | grep net2280 may help identify issues.

Impact Analysis

This vulnerability could cause kernel memory corruption or crashes if the probe error path is triggered, potentially leading to denial of service or privilege escalation in systems using the net2280 USB gadget driver.

Compliance Impact

This vulnerability involves a double free in the Linux kernel's USB gadget subsystem, which could lead to memory corruption or crashes. It does not directly impact data privacy or security controls required by GDPR or HIPAA, as it is a low-level memory management issue rather than a data exposure or access control flaw.

Mitigation Strategies

Update the Linux kernel to a patched version that includes the fix for this issue. Monitor kernel updates from your distribution vendor and apply them promptly. No additional configuration changes are required beyond the kernel update.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64242. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart