CVE-2026-64340

Awaiting Analysis Awaiting Analysis - Queue

USB: legousbtower Use-After-Free Fix

Publication date: 2026-07-25

Last updated on: 2026-08-11

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: USB: legousbtower: fix use-after-free on disconnect race mutex_unlock() may access the mutex structure after releasing the lock and therefore cannot be used to manage lifetime of objects directly (unlike spinlocks and refcounts). [1][2] Use a kref to release the driver data to avoid use-after-free in mutex_unlock() when release() races with disconnect(). [1] a51749ab34d9 ("locking/mutex: Document that mutex_unlock() is non-atomic") [2] 2b9d9e0a9ba0 ("locking/mutex: Clarify that mutex_unlock(), and most other sleeping locks, can still use the lock object after it's unlocked")

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-25

Last Modified

2026-08-11

Generated

2026-08-14

AI Q&A

2026-07-25

EPSS Evaluated

2026-08-13

NVD

CVE-2026-64340

EUVD

EUVD-2026-48884

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability is a use-after-free issue in the Linux kernel's USB legousbtower driver. It occurs when mutex_unlock() accesses freed memory during a disconnect race, potentially leading to system instability or crashes.

Detection Guidance

This vulnerability is specific to the Linux kernel's USB legousbtower driver and involves a use-after-free issue during disconnect races. Detection requires checking for kernel logs or crashes related to the legousbtower module. Commands like dmesg | grep legousbtower or journalctl -k | grep legousbtower may help identify issues.

Impact Analysis

If exploited, this could cause kernel crashes, data corruption, or privilege escalation on systems using the legousbtower USB driver. Users might experience system freezes or unexpected reboots.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it is a low-level kernel use-after-free issue in the USB legousbtower driver. Compliance impacts would depend on specific system configurations and data processing activities, not this technical flaw.

Mitigation Strategies

Immediate mitigation involves updating the Linux kernel to a patched version that resolves this issue. Disable the legousbtower driver if not in use by blacklisting it via modprobe.conf or removing it from kernel modules.

Hi! I’m here to help you understand CVE-2026-64340. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70