---
id: CVE-2026-64343
title: 'USB: ldusb: fix use-after-free on disconnect race'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  USB: ldusb: fix use-after-free on disconnect race

  mutex_unlock() may access the mutex structure after releasing the lock
  and therefore cannot be used to manage lifetim…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= ce0d7d3f575fc1ba6a89c3c651e710355590daff <
    fc55923a972e715f9a27187b47d4920709e23d85
  - >-
    Linux >= ce0d7d3f575fc1ba6a89c3c651e710355590daff <
    e5a9bdce4bfd3e2226b5f3df5fb8385d6935ee69
  - >-
    Linux >= ce0d7d3f575fc1ba6a89c3c651e710355590daff <
    af59829e67e11ba2511a9f8e4b9111afc7d1f550
  - >-
    Linux >= ce0d7d3f575fc1ba6a89c3c651e710355590daff <
    02ca08fff74cf9b0a3c4d2cacde1c6edeeb95bb4
  - >-
    Linux >= ce0d7d3f575fc1ba6a89c3c651e710355590daff <
    d8f69404e1d671326f86d378b9f5bfbd56490e9d
  - >-
    Linux >= ce0d7d3f575fc1ba6a89c3c651e710355590daff <
    2107a4fc8ff1cf1d52f416c1e5cc8e97413a5915
  - >-
    Linux >= ce0d7d3f575fc1ba6a89c3c651e710355590daff <
    a3e794136ab5e3ad1e7019175a4b837aec86db4b
  - >-
    Linux >= ce0d7d3f575fc1ba6a89c3c651e710355590daff <
    19bdfc7b3c179331eafa423d87e1336f43bbfeb8
  - Linux 2.6.26
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-06T16:36:05.674560Z'
published: '2026-07-25'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T16:44:47.559Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-64343'
references:
  - url: 'https://git.kernel.org/stable/c/fc55923a972e715f9a27187b47d4920709e23d85'
  - url: 'https://git.kernel.org/stable/c/e5a9bdce4bfd3e2226b5f3df5fb8385d6935ee69'
  - url: 'https://git.kernel.org/stable/c/af59829e67e11ba2511a9f8e4b9111afc7d1f550'
  - url: 'https://git.kernel.org/stable/c/02ca08fff74cf9b0a3c4d2cacde1c6edeeb95bb4'
  - url: 'https://git.kernel.org/stable/c/d8f69404e1d671326f86d378b9f5bfbd56490e9d'
  - url: 'https://git.kernel.org/stable/c/2107a4fc8ff1cf1d52f416c1e5cc8e97413a5915'
  - url: 'https://git.kernel.org/stable/c/a3e794136ab5e3ad1e7019175a4b837aec86db4b'
  - url: 'https://git.kernel.org/stable/c/19bdfc7b3c179331eafa423d87e1336f43bbfeb8'
tags:
  - cve.org
epss: 0.00126
epssPercentile: 0.02269
ingestedAt: '2026-11-06T16:57:43.194Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

USB: ldusb: fix use-after-free on disconnect race

mutex_unlock() may access the mutex structure after releasing the lock
and therefore cannot be used to manage lifetime of objects directly
(unlike spinlocks and refcounts). [1][2]

Use a kref to release the driver data to avoid use-after-free in
mutex_unlock() when release() races with disconnect().

[1] a51749ab34d9 ("locking/mutex: Document that mutex_unlock() is
                   non-atomic")
[2] 2b9d9e0a9ba0 ("locking/mutex: Clarify that mutex_unlock(), and most
                   other sleeping locks, can still use the lock object
                   after it's unlocked")

## Affected

- `Linux >= ce0d7d3f575fc1ba6a89c3c651e710355590daff < fc55923a972e715f9a27187b47d4920709e23d85`
- `Linux >= ce0d7d3f575fc1ba6a89c3c651e710355590daff < e5a9bdce4bfd3e2226b5f3df5fb8385d6935ee69`
- `Linux >= ce0d7d3f575fc1ba6a89c3c651e710355590daff < af59829e67e11ba2511a9f8e4b9111afc7d1f550`
- `Linux >= ce0d7d3f575fc1ba6a89c3c651e710355590daff < 02ca08fff74cf9b0a3c4d2cacde1c6edeeb95bb4`
- `Linux >= ce0d7d3f575fc1ba6a89c3c651e710355590daff < d8f69404e1d671326f86d378b9f5bfbd56490e9d`
- `Linux >= ce0d7d3f575fc1ba6a89c3c651e710355590daff < 2107a4fc8ff1cf1d52f416c1e5cc8e97413a5915`
- `Linux >= ce0d7d3f575fc1ba6a89c3c651e710355590daff < a3e794136ab5e3ad1e7019175a4b837aec86db4b`
- `Linux >= ce0d7d3f575fc1ba6a89c3c651e710355590daff < 19bdfc7b3c179331eafa423d87e1336f43bbfeb8`
- `Linux 2.6.26`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.