CVE-2026-64242

Analyzed Analyzed - Analysis Complete

Double Free in Linux Kernel USB Gadget Net2280

Publication date: 2026-07-24

Last updated on: 2026-08-13

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: net2280: Fix double free in probe error path usb_initialize_gadget() installs gadget_release() as the release callback for the embedded gadget device. The struct net2280 instance is therefore released through gadget_release() when the gadget device's last reference is dropped. The probe error path calls net2280_remove(), which tears down the partially initialized device and drops the gadget reference with usb_put_gadget(). Calling kfree(dev) afterwards can free the same object again. Drop the explicit kfree() and let the gadget device release callback handle the final free. This issue was found by a static analysis tool I am developing.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-24

Last Modified

2026-08-13

Generated

2026-08-14

AI Q&A

2026-07-24

EPSS Evaluated

2026-08-12

NVD

CVE-2026-64242

EUVD

EUVD-2026-48651

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	From 5.16 (inc) to 6.1.176 (exc)
linux	linux_kernel	From 6.13 (inc) to 6.18.35 (exc)
linux	linux_kernel	From 6.2 (inc) to 6.6.143 (exc)
linux	linux_kernel	From 6.7 (inc) to 6.12.93 (exc)
linux	linux_kernel	From 5.11 (inc) to 5.15.210 (exc)
linux	linux_kernel	From 5.10 (inc) to 5.10.259 (exc)
linux	linux_kernel	7.1
linux	linux_kernel	From 6.19 (inc) to 7.0.12 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-415	The product calls free() twice on the same memory address.

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a double free issue in the net2280 USB gadget driver. During probe error handling, the driver incorrectly calls kfree() on a device structure that is also released by the gadget device's release callback, leading to a double free of the same memory object.

Detection Guidance

This vulnerability is specific to the Linux kernel's net2280 USB gadget driver and may not have direct network detection methods. Check kernel logs for errors related to USB gadget initialization or device probe failures. Commands like dmesg | grep net2280 or journalctl -k | grep net2280 may help identify issues.

Impact Analysis

This vulnerability could cause kernel memory corruption or crashes if the probe error path is triggered, potentially leading to denial of service or privilege escalation in systems using the net2280 USB gadget driver.

Compliance Impact

This vulnerability involves a double free in the Linux kernel's USB gadget subsystem, which could lead to memory corruption or crashes. It does not directly impact data privacy or security controls required by GDPR or HIPAA, as it is a low-level memory management issue rather than a data exposure or access control flaw.

Mitigation Strategies

Update the Linux kernel to a patched version that includes the fix for this issue. Monitor kernel updates from your distribution vendor and apply them promptly. No additional configuration changes are required beyond the kernel update.

Hi! I’m here to help you understand CVE-2026-64242. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70