---
id: CVE-2026-64340
title: 'USB: legousbtower: fix use-after-free on disconnect race'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  USB: legousbtower: fix use-after-free on disconnect race

  mutex_unlock() may access the mutex structure after releasing the lock
  and therefore cannot be used to manage …
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 18bcbcfe9ca2308ebffb40068b51803da9315d97 <
    11d069f85851997b4ea0adf242ed9672dc749b8f
  - >-
    Linux >= 18bcbcfe9ca2308ebffb40068b51803da9315d97 <
    b4222c05066b252b451f9c8c4730b5b60824ea66
  - >-
    Linux >= 18bcbcfe9ca2308ebffb40068b51803da9315d97 <
    6462de75d2e370c7e74dcfb7b4ae79eb5a6a55ee
  - >-
    Linux >= 18bcbcfe9ca2308ebffb40068b51803da9315d97 <
    0b57e5ddbd89df3bc367463de3d2ca66f99a1a5e
  - >-
    Linux >= 18bcbcfe9ca2308ebffb40068b51803da9315d97 <
    ab2bfd7bec4f134b377ec42f513e90c35db94160
  - >-
    Linux >= 18bcbcfe9ca2308ebffb40068b51803da9315d97 <
    766738ecf2b819e54d38763c8d1c8ae6cff14b39
  - >-
    Linux >= 18bcbcfe9ca2308ebffb40068b51803da9315d97 <
    9ba62966461a8e3cc593b62c56ec62eb2d80436d
  - >-
    Linux >= 18bcbcfe9ca2308ebffb40068b51803da9315d97 <
    62fc8eb1b1481051f7bab4aa93d79809053dd09f
  - Linux 2.6.25
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-06T16:35:49.119408Z'
published: '2026-07-25'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T16:44:47.016Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-64340'
references:
  - url: 'https://git.kernel.org/stable/c/11d069f85851997b4ea0adf242ed9672dc749b8f'
  - url: 'https://git.kernel.org/stable/c/b4222c05066b252b451f9c8c4730b5b60824ea66'
  - url: 'https://git.kernel.org/stable/c/6462de75d2e370c7e74dcfb7b4ae79eb5a6a55ee'
  - url: 'https://git.kernel.org/stable/c/0b57e5ddbd89df3bc367463de3d2ca66f99a1a5e'
  - url: 'https://git.kernel.org/stable/c/ab2bfd7bec4f134b377ec42f513e90c35db94160'
  - url: 'https://git.kernel.org/stable/c/766738ecf2b819e54d38763c8d1c8ae6cff14b39'
  - url: 'https://git.kernel.org/stable/c/9ba62966461a8e3cc593b62c56ec62eb2d80436d'
  - url: 'https://git.kernel.org/stable/c/62fc8eb1b1481051f7bab4aa93d79809053dd09f'
tags:
  - cve.org
epss: 0.00126
epssPercentile: 0.02273
ingestedAt: '2026-11-06T16:57:43.195Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

USB: legousbtower: fix use-after-free on disconnect race

mutex_unlock() may access the mutex structure after releasing the lock
and therefore cannot be used to manage lifetime of objects directly
(unlike spinlocks and refcounts). [1][2]

Use a kref to release the driver data to avoid use-after-free in
mutex_unlock() when release() races with disconnect().

[1] a51749ab34d9 ("locking/mutex: Document that mutex_unlock() is
                   non-atomic")
[2] 2b9d9e0a9ba0 ("locking/mutex: Clarify that mutex_unlock(), and most
                   other sleeping locks, can still use the lock object
                   after it's unlocked")

## Affected

- `Linux >= 18bcbcfe9ca2308ebffb40068b51803da9315d97 < 11d069f85851997b4ea0adf242ed9672dc749b8f`
- `Linux >= 18bcbcfe9ca2308ebffb40068b51803da9315d97 < b4222c05066b252b451f9c8c4730b5b60824ea66`
- `Linux >= 18bcbcfe9ca2308ebffb40068b51803da9315d97 < 6462de75d2e370c7e74dcfb7b4ae79eb5a6a55ee`
- `Linux >= 18bcbcfe9ca2308ebffb40068b51803da9315d97 < 0b57e5ddbd89df3bc367463de3d2ca66f99a1a5e`
- `Linux >= 18bcbcfe9ca2308ebffb40068b51803da9315d97 < ab2bfd7bec4f134b377ec42f513e90c35db94160`
- `Linux >= 18bcbcfe9ca2308ebffb40068b51803da9315d97 < 766738ecf2b819e54d38763c8d1c8ae6cff14b39`
- `Linux >= 18bcbcfe9ca2308ebffb40068b51803da9315d97 < 9ba62966461a8e3cc593b62c56ec62eb2d80436d`
- `Linux >= 18bcbcfe9ca2308ebffb40068b51803da9315d97 < 62fc8eb1b1481051f7bab4aa93d79809053dd09f`
- `Linux 2.6.25`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.