CVE-2026-64344

Analyzed Analyzed - Analysis Complete

USB: idmouse Use-After-Free on Disconnect Race

Publication date: 2026-07-25

Last updated on: 2026-09-03

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: USB: idmouse: fix use-after-free on disconnect race mutex_unlock() may access the mutex structure after releasing the lock and therefore cannot be used to manage lifetime of objects directly (unlike spinlocks and refcounts). [1][2] Use a kref to release the driver data to avoid use-after-free in mutex_unlock() when release() races with disconnect(). [1] a51749ab34d9 ("locking/mutex: Document that mutex_unlock() is non-atomic") [2] 2b9d9e0a9ba0 ("locking/mutex: Clarify that mutex_unlock(), and most other sleeping locks, can still use the lock object after it's unlocked")

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-25

Last Modified

2026-09-03

Generated

2026-09-23

AI Q&A

2026-07-25

EPSS Evaluated

2026-09-22

NVD

CVE-2026-64344

EUVD

EUVD-2026-48888

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	2.6.24
linux	linux_kernel	2.6.24
linux	linux_kernel	2.6.24
linux	linux_kernel	2.6.24
linux	linux_kernel	2.6.24
linux	linux_kernel	2.6.24
linux	linux_kernel	2.6.24
linux	linux_kernel	2.6.24
linux	linux_kernel	From 5.11 (inc) to 5.15.212 (exc)
linux	linux_kernel	From 5.16 (inc) to 6.1.178 (exc)
linux	linux_kernel	From 6.2 (inc) to 6.6.145 (exc)
linux	linux_kernel	From 6.7 (inc) to 6.12.96 (exc)
linux	linux_kernel	From 6.13 (inc) to 6.18.39 (exc)
linux	linux_kernel	From 6.19 (inc) to 7.1.4 (exc)
linux	linux_kernel	7.2
linux	linux_kernel	7.2
linux	linux_kernel	From 2.6.24.1 (inc) to 5.10.261 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-416	The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

Executive Summary

This is a use-after-free vulnerability in the Linux kernel's USB idmouse driver. It occurs when the driver's disconnect function races with the release function, causing mutex_unlock() to access freed memory. The fix uses a kref to properly manage driver data lifetime.

Detection Guidance

This vulnerability is specific to the Linux kernel's USB idmouse driver and requires kernel-level detection. Check kernel logs for use-after-free errors related to the idmouse driver using dmesg | grep idmouse or journalctl -k | grep idmouse. Monitor for crashes or system instability after USB device disconnections.

Impact Analysis

If exploited, this could allow local attackers to cause denial of service or potentially execute arbitrary code with kernel privileges. Systems using vulnerable Linux kernels with USB input devices may be affected.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it is a low-level kernel issue related to USB driver memory management. Compliance impacts would depend on system-specific implementations rather than this specific flaw.

Mitigation Strategies

Update your Linux kernel to the latest patched version that includes the fix for this vulnerability. If immediate patching is not possible, consider disabling the idmouse driver module (modprobe -r usbhid) as a temporary workaround until a kernel update is applied.

Hi! I’m here to help you understand CVE-2026-64344. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70