{"id":"CVE-2026-64345","title":"usb: gadget: f_printer: take kref only for successful open","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: f_printer: take kref only for successful open\n\nprinter_open() returns -EBUSY when the character device is already\nopen, but it increments dev->kref regardl…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= e8d5f92b8d30bb4ade76494490c3c065e12411b1 < 94ec20d97aa51547965a539f660a1fe79c6929a3","Linux >= e8d5f92b8d30bb4ade76494490c3c065e12411b1 < a12d81a9cc2a012a24ecb7f9ba076b9f7c179bd3","Linux >= e8d5f92b8d30bb4ade76494490c3c065e12411b1 < 75c0ad13e136961328253742501b4efc3988a587","Linux >= e8d5f92b8d30bb4ade76494490c3c065e12411b1 < bf20c94fa6aaff945f0ae3a23f3212cd299f28d9","Linux >= e8d5f92b8d30bb4ade76494490c3c065e12411b1 < 8a5eba992c862b0c94411eecf9b7121e8636db38","Linux >= e8d5f92b8d30bb4ade76494490c3c065e12411b1 < 7f1f24c367938c5537e2308bf9a965f051d14774","Linux >= e8d5f92b8d30bb4ade76494490c3c065e12411b1 < 30adce93d5c4a5a1ec29d9249e3fdfcc391d406b","Linux 25c95c6bd4dc50a3c20de0fa7f450ea02b2320fc","Linux 4a47581cf010dc351d8069978080fdb000c0776d","Linux d9fe88b2a38dc700bf5bd3a09c7cd11bbc248367","Linux cedb0187b8ba929c3f76f28e6bc25804d65f8a54","Linux e9e791f5c39ab30e374a3b1a9c25ca7ff24988f3","Linux 34f026263889e2827e04acdc3a0eb9ecbd191ef0","Linux 5f845e5d18d151230476cf90aa46449f69ba2ef1","Linux >= 4.4.241 < 4.5","Linux >= 4.9.241 < 4.10","Linux >= 4.14.203 < 4.15","Linux >= 4.19.154 < 4.20","Linux >= 5.4.73 < 5.5","Linux >= 5.8.17 < 5.9","Linux >= 5.9.2 < 5.10","Linux 5.10"],"published":"2026-07-25","updated":"2026-10-30","sourceUpdated":"2026-10-30T12:27:47.119Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-64345","references":[{"url":"https://git.kernel.org/stable/c/94ec20d97aa51547965a539f660a1fe79c6929a3"},{"url":"https://git.kernel.org/stable/c/a12d81a9cc2a012a24ecb7f9ba076b9f7c179bd3"},{"url":"https://git.kernel.org/stable/c/75c0ad13e136961328253742501b4efc3988a587"},{"url":"https://git.kernel.org/stable/c/bf20c94fa6aaff945f0ae3a23f3212cd299f28d9"},{"url":"https://git.kernel.org/stable/c/8a5eba992c862b0c94411eecf9b7121e8636db38"},{"url":"https://git.kernel.org/stable/c/7f1f24c367938c5537e2308bf9a965f051d14774"},{"url":"https://git.kernel.org/stable/c/30adce93d5c4a5a1ec29d9249e3fdfcc391d406b"}],"tags":["cve.org"],"epss":0.00123,"epssPercentile":0.02045,"ingestedAt":"2026-11-05T15:02:32.422Z","slug":"CVE-2026-64345","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: f_printer: take kref only for successful open\n\nprinter_open() returns -EBUSY when the character device is already\nopen, but it increments dev->kref regardless of the return value. VFS\ndoes not call ->release() for a failed open, so every rejected second\nopen permanently leaks one reference.\n\nMove kref_get() into the successful-open branch.\n\n## Affected\n\n- `Linux >= e8d5f92b8d30bb4ade76494490c3c065e12411b1 < 94ec20d97aa51547965a539f660a1fe79c6929a3`\n- `Linux >= e8d5f92b8d30bb4ade76494490c3c065e12411b1 < a12d81a9cc2a012a24ecb7f9ba076b9f7c179bd3`\n- `Linux >= e8d5f92b8d30bb4ade76494490c3c065e12411b1 < 75c0ad13e136961328253742501b4efc3988a587`\n- `Linux >= e8d5f92b8d30bb4ade76494490c3c065e12411b1 < bf20c94fa6aaff945f0ae3a23f3212cd299f28d9`\n- `Linux >= e8d5f92b8d30bb4ade76494490c3c065e12411b1 < 8a5eba992c862b0c94411eecf9b7121e8636db38`\n- `Linux >= e8d5f92b8d30bb4ade76494490c3c065e12411b1 < 7f1f24c367938c5537e2308bf9a965f051d14774`\n- `Linux >= e8d5f92b8d30bb4ade76494490c3c065e12411b1 < 30adce93d5c4a5a1ec29d9249e3fdfcc391d406b`\n- `Linux 25c95c6bd4dc50a3c20de0fa7f450ea02b2320fc`\n- `Linux 4a47581cf010dc351d8069978080fdb000c0776d`\n- `Linux d9fe88b2a38dc700bf5bd3a09c7cd11bbc248367`\n- `Linux cedb0187b8ba929c3f76f28e6bc25804d65f8a54`\n- `Linux e9e791f5c39ab30e374a3b1a9c25ca7ff24988f3`\n- `Linux 34f026263889e2827e04acdc3a0eb9ecbd191ef0`\n- `Linux 5f845e5d18d151230476cf90aa46449f69ba2ef1`\n- `Linux >= 4.4.241 < 4.5`\n- `Linux >= 4.9.241 < 4.10`\n- `Linux >= 4.14.203 < 4.15`\n- `Linux >= 4.19.154 < 4.20`\n- `Linux >= 5.4.73 < 5.5`\n- `Linux >= 5.8.17 < 5.9`\n- `Linux >= 5.9.2 < 5.10`\n- `Linux 5.10`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}