CVE-2026-64345
Received Received - Intake

BaseFortify

Publication date: 2026-07-25

Last updated on: 2026-07-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_printer: take kref only for successful open printer_open() returns -EBUSY when the character device is already open, but it increments dev->kref regardless of the return value. VFS does not call ->release() for a failed open, so every rejected second open permanently leaks one reference. Move kref_get() into the successful-open branch.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-25
Last Modified
2026-07-25
Generated
2026-07-25
AI Q&A
2026-07-25
EPSS Evaluated
N/A
NVD
CVE-2026-64345
EUVD
EUVD-2026-48889

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a reference count leak in the USB gadget printer function. When a second attempt is made to open the character device while it is already open, the function returns an error but still increments a reference counter. Since the VFS does not call the release function for failed opens, this causes a permanent leak of one reference per failed attempt.

Detection Guidance

This vulnerability is specific to the Linux kernel's USB gadget printer function and does not have a direct network detection method. It can only be detected by checking the kernel version and inspecting the printer gadget driver code for the kref leak issue.

Impact Analysis

This vulnerability can lead to resource exhaustion over time. If exploited repeatedly, it may cause the system to run out of available references, potentially leading to crashes or degraded performance in the USB gadget functionality.

Mitigation Strategies

Apply the latest Linux kernel update that includes the fix for this issue. If updating is not immediately possible, avoid using the USB gadget printer function until the patch is applied to prevent potential resource leaks.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64345. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart