CVE-2026-64455
Received Received - Intake

USB: chaoskey Use-After-Free in Release Routine

Publication date: 2026-07-25

Last updated on: 2026-07-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: USB: chaoskey: Fix slab-use-after-free in chaoskey_release() The chaoskey driver has a use-after-free bug in its release routine. If the user closes the device file after the USB device has been unplugged, a debugging log statement will try to access the usb_interface structure after it has been deallocated: BUG: KASAN: slab-use-after-free in dev_driver_string (drivers/base/core.c:2406) Read of size 8 at addr ffff888168e8a0b8 by task chaoskey_raw_re/10106 Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Call Trace: <TASK> dump_stack_lvl (lib/dump_stack.c:94 lib/dump_stack.c:120) print_report (mm/kasan/report.c:378 mm/kasan/report.c:482) kasan_report (mm/kasan/report.c:595) dev_driver_string (drivers/base/core.c:2406) __dynamic_dev_dbg (lib/dynamic_debug.c:906) chaoskey_release (drivers/usb/misc/chaoskey.c:323) __fput (fs/file_table.c:510) fput_close_sync (fs/file_table.c:615) __x64_sys_close (fs/open.c:1507 fs/open.c:1492 fs/open.c:1492) do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121) The driver's last reference to the interface structure is dropped in the chaoskey_free() routine, so the code must not use the interface -- even in a debugging statement -- after that routine returns. (Exception: If we know that another reference is held by someone else, such as the device core while the disconnect routine runs, there's no problem. Thanks to Johan Hovold for pointing this out.) Since the bad access is part of an unimportant debugging statement, we can fix the problem simply by removing the whole statement.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-25
Last Modified
2026-07-25
Generated
2026-08-14
AI Q&A
2026-07-25
EPSS Evaluated
2026-08-13
NVD
CVE-2026-64455
EUVD
EUVD-2026-48799

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a use-after-free vulnerability in the Linux kernel's chaoskey USB driver. It occurs when the driver tries to access freed memory in a debugging log statement after the USB device is unplugged and its interface structure is deallocated. The issue happens in the chaoskey_release() function when closing the device file.

Detection Guidance

This vulnerability is specific to the Linux kernel's chaoskey USB driver and may not have direct network detection methods. Monitor kernel logs for slab-use-after-free errors related to chaoskey_release() using commands like dmesg | grep -i 'KASAN\|slab-use-after-free\|chaoskey'.

Impact Analysis

This vulnerability could cause system instability or crashes if exploited. It may lead to kernel memory corruption or privilege escalation in rare cases. However, the impact is limited since the bug only triggers during specific debugging scenarios involving unplugged USB devices.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA as it is a low-impact kernel driver issue with no data exposure or security implications.

Mitigation Strategies

Apply the Linux kernel patch that resolves this issue. If using a vulnerable kernel version, avoid unplugging chaoskey USB devices while the device file is open. Update to a patched kernel version as soon as possible.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64455. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart