{"id":"CVE-2026-64343","title":"USB: ldusb: fix use-after-free on disconnect race","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: ldusb: fix use-after-free on disconnect race\n\nmutex_unlock() may access the mutex structure after releasing the lock\nand therefore cannot be used to manage lifetim…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= ce0d7d3f575fc1ba6a89c3c651e710355590daff < fc55923a972e715f9a27187b47d4920709e23d85","Linux >= ce0d7d3f575fc1ba6a89c3c651e710355590daff < e5a9bdce4bfd3e2226b5f3df5fb8385d6935ee69","Linux >= ce0d7d3f575fc1ba6a89c3c651e710355590daff < af59829e67e11ba2511a9f8e4b9111afc7d1f550","Linux >= ce0d7d3f575fc1ba6a89c3c651e710355590daff < 02ca08fff74cf9b0a3c4d2cacde1c6edeeb95bb4","Linux >= ce0d7d3f575fc1ba6a89c3c651e710355590daff < d8f69404e1d671326f86d378b9f5bfbd56490e9d","Linux >= ce0d7d3f575fc1ba6a89c3c651e710355590daff < 2107a4fc8ff1cf1d52f416c1e5cc8e97413a5915","Linux >= ce0d7d3f575fc1ba6a89c3c651e710355590daff < a3e794136ab5e3ad1e7019175a4b837aec86db4b","Linux >= ce0d7d3f575fc1ba6a89c3c651e710355590daff < 19bdfc7b3c179331eafa423d87e1336f43bbfeb8","Linux 2.6.26"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-06T16:36:05.674560Z"},"published":"2026-07-25","updated":"2026-11-06","sourceUpdated":"2026-11-06T16:44:47.559Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-64343","references":[{"url":"https://git.kernel.org/stable/c/fc55923a972e715f9a27187b47d4920709e23d85"},{"url":"https://git.kernel.org/stable/c/e5a9bdce4bfd3e2226b5f3df5fb8385d6935ee69"},{"url":"https://git.kernel.org/stable/c/af59829e67e11ba2511a9f8e4b9111afc7d1f550"},{"url":"https://git.kernel.org/stable/c/02ca08fff74cf9b0a3c4d2cacde1c6edeeb95bb4"},{"url":"https://git.kernel.org/stable/c/d8f69404e1d671326f86d378b9f5bfbd56490e9d"},{"url":"https://git.kernel.org/stable/c/2107a4fc8ff1cf1d52f416c1e5cc8e97413a5915"},{"url":"https://git.kernel.org/stable/c/a3e794136ab5e3ad1e7019175a4b837aec86db4b"},{"url":"https://git.kernel.org/stable/c/19bdfc7b3c179331eafa423d87e1336f43bbfeb8"}],"tags":["cve.org"],"epss":0.00126,"epssPercentile":0.02269,"ingestedAt":"2026-11-06T16:57:43.194Z","slug":"CVE-2026-64343","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nUSB: ldusb: fix use-after-free on disconnect race\n\nmutex_unlock() may access the mutex structure after releasing the lock\nand therefore cannot be used to manage lifetime of objects directly\n(unlike spinlocks and refcounts). [1][2]\n\nUse a kref to release the driver data to avoid use-after-free in\nmutex_unlock() when release() races with disconnect().\n\n[1] a51749ab34d9 (\"locking/mutex: Document that mutex_unlock() is\n                   non-atomic\")\n[2] 2b9d9e0a9ba0 (\"locking/mutex: Clarify that mutex_unlock(), and most\n                   other sleeping locks, can still use the lock object\n                   after it's unlocked\")\n\n## Affected\n\n- `Linux >= ce0d7d3f575fc1ba6a89c3c651e710355590daff < fc55923a972e715f9a27187b47d4920709e23d85`\n- `Linux >= ce0d7d3f575fc1ba6a89c3c651e710355590daff < e5a9bdce4bfd3e2226b5f3df5fb8385d6935ee69`\n- `Linux >= ce0d7d3f575fc1ba6a89c3c651e710355590daff < af59829e67e11ba2511a9f8e4b9111afc7d1f550`\n- `Linux >= ce0d7d3f575fc1ba6a89c3c651e710355590daff < 02ca08fff74cf9b0a3c4d2cacde1c6edeeb95bb4`\n- `Linux >= ce0d7d3f575fc1ba6a89c3c651e710355590daff < d8f69404e1d671326f86d378b9f5bfbd56490e9d`\n- `Linux >= ce0d7d3f575fc1ba6a89c3c651e710355590daff < 2107a4fc8ff1cf1d52f416c1e5cc8e97413a5915`\n- `Linux >= ce0d7d3f575fc1ba6a89c3c651e710355590daff < a3e794136ab5e3ad1e7019175a4b837aec86db4b`\n- `Linux >= ce0d7d3f575fc1ba6a89c3c651e710355590daff < 19bdfc7b3c179331eafa423d87e1336f43bbfeb8`\n- `Linux 2.6.26`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}