{"id":"CVE-2026-64340","title":"USB: legousbtower: fix use-after-free on disconnect race","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: legousbtower: fix use-after-free on disconnect race\n\nmutex_unlock() may access the mutex structure after releasing the lock\nand therefore cannot be used to manage …","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 18bcbcfe9ca2308ebffb40068b51803da9315d97 < 11d069f85851997b4ea0adf242ed9672dc749b8f","Linux >= 18bcbcfe9ca2308ebffb40068b51803da9315d97 < b4222c05066b252b451f9c8c4730b5b60824ea66","Linux >= 18bcbcfe9ca2308ebffb40068b51803da9315d97 < 6462de75d2e370c7e74dcfb7b4ae79eb5a6a55ee","Linux >= 18bcbcfe9ca2308ebffb40068b51803da9315d97 < 0b57e5ddbd89df3bc367463de3d2ca66f99a1a5e","Linux >= 18bcbcfe9ca2308ebffb40068b51803da9315d97 < ab2bfd7bec4f134b377ec42f513e90c35db94160","Linux >= 18bcbcfe9ca2308ebffb40068b51803da9315d97 < 766738ecf2b819e54d38763c8d1c8ae6cff14b39","Linux >= 18bcbcfe9ca2308ebffb40068b51803da9315d97 < 9ba62966461a8e3cc593b62c56ec62eb2d80436d","Linux >= 18bcbcfe9ca2308ebffb40068b51803da9315d97 < 62fc8eb1b1481051f7bab4aa93d79809053dd09f","Linux 2.6.25"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-06T16:35:49.119408Z"},"published":"2026-07-25","updated":"2026-11-06","sourceUpdated":"2026-11-06T16:44:47.016Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-64340","references":[{"url":"https://git.kernel.org/stable/c/11d069f85851997b4ea0adf242ed9672dc749b8f"},{"url":"https://git.kernel.org/stable/c/b4222c05066b252b451f9c8c4730b5b60824ea66"},{"url":"https://git.kernel.org/stable/c/6462de75d2e370c7e74dcfb7b4ae79eb5a6a55ee"},{"url":"https://git.kernel.org/stable/c/0b57e5ddbd89df3bc367463de3d2ca66f99a1a5e"},{"url":"https://git.kernel.org/stable/c/ab2bfd7bec4f134b377ec42f513e90c35db94160"},{"url":"https://git.kernel.org/stable/c/766738ecf2b819e54d38763c8d1c8ae6cff14b39"},{"url":"https://git.kernel.org/stable/c/9ba62966461a8e3cc593b62c56ec62eb2d80436d"},{"url":"https://git.kernel.org/stable/c/62fc8eb1b1481051f7bab4aa93d79809053dd09f"}],"tags":["cve.org"],"epss":0.00126,"epssPercentile":0.02273,"ingestedAt":"2026-11-06T16:57:43.195Z","slug":"CVE-2026-64340","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nUSB: legousbtower: fix use-after-free on disconnect race\n\nmutex_unlock() may access the mutex structure after releasing the lock\nand therefore cannot be used to manage lifetime of objects directly\n(unlike spinlocks and refcounts). [1][2]\n\nUse a kref to release the driver data to avoid use-after-free in\nmutex_unlock() when release() races with disconnect().\n\n[1] a51749ab34d9 (\"locking/mutex: Document that mutex_unlock() is\n                   non-atomic\")\n[2] 2b9d9e0a9ba0 (\"locking/mutex: Clarify that mutex_unlock(), and most\n                   other sleeping locks, can still use the lock object\n                   after it's unlocked\")\n\n## Affected\n\n- `Linux >= 18bcbcfe9ca2308ebffb40068b51803da9315d97 < 11d069f85851997b4ea0adf242ed9672dc749b8f`\n- `Linux >= 18bcbcfe9ca2308ebffb40068b51803da9315d97 < b4222c05066b252b451f9c8c4730b5b60824ea66`\n- `Linux >= 18bcbcfe9ca2308ebffb40068b51803da9315d97 < 6462de75d2e370c7e74dcfb7b4ae79eb5a6a55ee`\n- `Linux >= 18bcbcfe9ca2308ebffb40068b51803da9315d97 < 0b57e5ddbd89df3bc367463de3d2ca66f99a1a5e`\n- `Linux >= 18bcbcfe9ca2308ebffb40068b51803da9315d97 < ab2bfd7bec4f134b377ec42f513e90c35db94160`\n- `Linux >= 18bcbcfe9ca2308ebffb40068b51803da9315d97 < 766738ecf2b819e54d38763c8d1c8ae6cff14b39`\n- `Linux >= 18bcbcfe9ca2308ebffb40068b51803da9315d97 < 9ba62966461a8e3cc593b62c56ec62eb2d80436d`\n- `Linux >= 18bcbcfe9ca2308ebffb40068b51803da9315d97 < 62fc8eb1b1481051f7bab4aa93d79809053dd09f`\n- `Linux 2.6.25`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}