{"id":"CVE-2026-64344","title":"USB: idmouse: fix use-after-free on disconnect race","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: idmouse: fix use-after-free on disconnect race\n\nmutex_unlock() may access the mutex structure after releasing the lock\nand therefore cannot be used to manage lifet…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 54d2bc068fd21bcb096660938bce7c7265613a24 < 31e75fed8f90cfea9f8285e7ed135b0e452bf872","Linux >= 54d2bc068fd21bcb096660938bce7c7265613a24 < 8d53b14ad4ccbff6d306b3a39c812303f4a87d41","Linux >= 54d2bc068fd21bcb096660938bce7c7265613a24 < f62622e947f82a3854a8502d09492ffbdeb252b4","Linux >= 54d2bc068fd21bcb096660938bce7c7265613a24 < 60fc5ef4ecea3e3d1fe556cecf53ddd13096ef09","Linux >= 54d2bc068fd21bcb096660938bce7c7265613a24 < d0f61acb51a8c8f3fd41c303ddb7770cd83e7ed4","Linux >= 54d2bc068fd21bcb096660938bce7c7265613a24 < 54c2b7356b4aeea467f9fb13b85e9e036bc428cb","Linux >= 54d2bc068fd21bcb096660938bce7c7265613a24 < e88cff5fbaa629f3cab45c8b46f395d62c2eb515","Linux >= 54d2bc068fd21bcb096660938bce7c7265613a24 < ff002c153f9722caece3983cc23dc4d9d4652cb4","Linux 2.6.24"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-06T16:36:11.234531Z"},"published":"2026-07-25","updated":"2026-11-06","sourceUpdated":"2026-11-06T16:44:47.749Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-64344","references":[{"url":"https://git.kernel.org/stable/c/31e75fed8f90cfea9f8285e7ed135b0e452bf872"},{"url":"https://git.kernel.org/stable/c/8d53b14ad4ccbff6d306b3a39c812303f4a87d41"},{"url":"https://git.kernel.org/stable/c/f62622e947f82a3854a8502d09492ffbdeb252b4"},{"url":"https://git.kernel.org/stable/c/60fc5ef4ecea3e3d1fe556cecf53ddd13096ef09"},{"url":"https://git.kernel.org/stable/c/d0f61acb51a8c8f3fd41c303ddb7770cd83e7ed4"},{"url":"https://git.kernel.org/stable/c/54c2b7356b4aeea467f9fb13b85e9e036bc428cb"},{"url":"https://git.kernel.org/stable/c/e88cff5fbaa629f3cab45c8b46f395d62c2eb515"},{"url":"https://git.kernel.org/stable/c/ff002c153f9722caece3983cc23dc4d9d4652cb4"}],"tags":["cve.org"],"epss":0.00126,"epssPercentile":0.02271,"ingestedAt":"2026-11-06T16:57:43.193Z","slug":"CVE-2026-64344","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nUSB: idmouse: fix use-after-free on disconnect race\n\nmutex_unlock() may access the mutex structure after releasing the lock\nand therefore cannot be used to manage lifetime of objects directly\n(unlike spinlocks and refcounts). [1][2]\n\nUse a kref to release the driver data to avoid use-after-free in\nmutex_unlock() when release() races with disconnect().\n\n[1] a51749ab34d9 (\"locking/mutex: Document that mutex_unlock() is\n                   non-atomic\")\n[2] 2b9d9e0a9ba0 (\"locking/mutex: Clarify that mutex_unlock(), and most\n                   other sleeping locks, can still use the lock object\n                   after it's unlocked\")\n\n## Affected\n\n- `Linux >= 54d2bc068fd21bcb096660938bce7c7265613a24 < 31e75fed8f90cfea9f8285e7ed135b0e452bf872`\n- `Linux >= 54d2bc068fd21bcb096660938bce7c7265613a24 < 8d53b14ad4ccbff6d306b3a39c812303f4a87d41`\n- `Linux >= 54d2bc068fd21bcb096660938bce7c7265613a24 < f62622e947f82a3854a8502d09492ffbdeb252b4`\n- `Linux >= 54d2bc068fd21bcb096660938bce7c7265613a24 < 60fc5ef4ecea3e3d1fe556cecf53ddd13096ef09`\n- `Linux >= 54d2bc068fd21bcb096660938bce7c7265613a24 < d0f61acb51a8c8f3fd41c303ddb7770cd83e7ed4`\n- `Linux >= 54d2bc068fd21bcb096660938bce7c7265613a24 < 54c2b7356b4aeea467f9fb13b85e9e036bc428cb`\n- `Linux >= 54d2bc068fd21bcb096660938bce7c7265613a24 < e88cff5fbaa629f3cab45c8b46f395d62c2eb515`\n- `Linux >= 54d2bc068fd21bcb096660938bce7c7265613a24 < ff002c153f9722caece3983cc23dc4d9d4652cb4`\n- `Linux 2.6.24`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}