CVE-2026-64338

Analyzed Analyzed - Analysis Complete

USB: uss720 Parport Registration Failure on Probe Error

Publication date: 2026-07-25

Last updated on: 2026-09-03

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: USB: misc: uss720: unregister parport on probe failure uss720_probe() registers a parport before reading the 1284 register used to detect unsupported Belkin F5U002 adapters. If get_1284_register() fails, the error path drops the driver private data and the USB device reference, but leaves the parport device registered. Leaving the port registered is more than a private allocation leak: parport_register_port() has already reserved a parport number and registered the parport bus device, while pp->private_data still points at the private data that the common error path is about to release. Undo the pre-announce registration in the get_1284_register() failure branch before jumping to the common private-data cleanup path. Clear priv->pp first, matching the disconnect path and avoiding a stale pointer in the private data. This issue was identified during our ongoing static-analysis research while reviewing kernel code.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-25

Last Modified

2026-09-03

Generated

2026-09-24

AI Q&A

2026-07-25

EPSS Evaluated

2026-09-22

NVD

CVE-2026-64338

EUVD

EUVD-2026-48882

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	From 4.19.317 (inc) to 4.20 (exc)
linux	linux_kernel	From 6.13 (inc) to 6.18.39 (exc)
linux	linux_kernel	From 6.19 (inc) to 7.1.4 (exc)
linux	linux_kernel	7.2
linux	linux_kernel	7.2
linux	linux_kernel	From 5.10.221 (inc) to 5.10.261 (exc)
linux	linux_kernel	From 5.15.162 (inc) to 5.15.212 (exc)
linux	linux_kernel	From 5.4.279 (inc) to 5.5 (exc)
linux	linux_kernel	From 6.1.96 (inc) to 6.1.178 (exc)
linux	linux_kernel	From 6.6.36 (inc) to 6.6.145 (exc)
linux	linux_kernel	From 6.9.7 (inc) to 6.12.96 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves improper handling during the probe process of the uss720 USB driver. When probing fails, the driver leaves a parallel port device registered even though the driver's private data and USB device reference are dropped. This can lead to resource leaks and potential system instability.

Detection Guidance

This vulnerability is specific to the Linux kernel's USB subsystem and does not have a direct network detection method. It can be detected by checking kernel logs for parport registration errors or by inspecting the uss720 driver for failed probe attempts. Use commands like dmesg | grep uss720 or journalctl -k | grep uss720 to review kernel logs for related errors.

Impact Analysis

This vulnerability could cause system instability by leaking resources. It may also lead to unexpected behavior if the stale parallel port device interferes with other system operations or drivers.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA. It involves a kernel-level issue in the Linux USB subsystem where a parport device remains registered after a probe failure, leading to a resource leak. There is no indication this impacts data protection, privacy, or security controls required by GDPR or HIPAA.

Mitigation Strategies

Update your Linux kernel to the latest stable version where this vulnerability has been patched. If you cannot update immediately, consider disabling the uss720 driver module by running modprobe -r uss720. Ensure no Belkin F5U002 adapters are connected to avoid potential issues.

Hi! I’m here to help you understand CVE-2026-64338. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70