---
id: CVE-2026-64344
title: 'USB: idmouse: fix use-after-free on disconnect race'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  USB: idmouse: fix use-after-free on disconnect race

  mutex_unlock() may access the mutex structure after releasing the lock
  and therefore cannot be used to manage lifet…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 54d2bc068fd21bcb096660938bce7c7265613a24 <
    31e75fed8f90cfea9f8285e7ed135b0e452bf872
  - >-
    Linux >= 54d2bc068fd21bcb096660938bce7c7265613a24 <
    8d53b14ad4ccbff6d306b3a39c812303f4a87d41
  - >-
    Linux >= 54d2bc068fd21bcb096660938bce7c7265613a24 <
    f62622e947f82a3854a8502d09492ffbdeb252b4
  - >-
    Linux >= 54d2bc068fd21bcb096660938bce7c7265613a24 <
    60fc5ef4ecea3e3d1fe556cecf53ddd13096ef09
  - >-
    Linux >= 54d2bc068fd21bcb096660938bce7c7265613a24 <
    d0f61acb51a8c8f3fd41c303ddb7770cd83e7ed4
  - >-
    Linux >= 54d2bc068fd21bcb096660938bce7c7265613a24 <
    54c2b7356b4aeea467f9fb13b85e9e036bc428cb
  - >-
    Linux >= 54d2bc068fd21bcb096660938bce7c7265613a24 <
    e88cff5fbaa629f3cab45c8b46f395d62c2eb515
  - >-
    Linux >= 54d2bc068fd21bcb096660938bce7c7265613a24 <
    ff002c153f9722caece3983cc23dc4d9d4652cb4
  - Linux 2.6.24
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-06T16:36:11.234531Z'
published: '2026-07-25'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T16:44:47.749Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-64344'
references:
  - url: 'https://git.kernel.org/stable/c/31e75fed8f90cfea9f8285e7ed135b0e452bf872'
  - url: 'https://git.kernel.org/stable/c/8d53b14ad4ccbff6d306b3a39c812303f4a87d41'
  - url: 'https://git.kernel.org/stable/c/f62622e947f82a3854a8502d09492ffbdeb252b4'
  - url: 'https://git.kernel.org/stable/c/60fc5ef4ecea3e3d1fe556cecf53ddd13096ef09'
  - url: 'https://git.kernel.org/stable/c/d0f61acb51a8c8f3fd41c303ddb7770cd83e7ed4'
  - url: 'https://git.kernel.org/stable/c/54c2b7356b4aeea467f9fb13b85e9e036bc428cb'
  - url: 'https://git.kernel.org/stable/c/e88cff5fbaa629f3cab45c8b46f395d62c2eb515'
  - url: 'https://git.kernel.org/stable/c/ff002c153f9722caece3983cc23dc4d9d4652cb4'
tags:
  - cve.org
epss: 0.00126
epssPercentile: 0.02271
ingestedAt: '2026-11-06T16:57:43.193Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

USB: idmouse: fix use-after-free on disconnect race

mutex_unlock() may access the mutex structure after releasing the lock
and therefore cannot be used to manage lifetime of objects directly
(unlike spinlocks and refcounts). [1][2]

Use a kref to release the driver data to avoid use-after-free in
mutex_unlock() when release() races with disconnect().

[1] a51749ab34d9 ("locking/mutex: Document that mutex_unlock() is
                   non-atomic")
[2] 2b9d9e0a9ba0 ("locking/mutex: Clarify that mutex_unlock(), and most
                   other sleeping locks, can still use the lock object
                   after it's unlocked")

## Affected

- `Linux >= 54d2bc068fd21bcb096660938bce7c7265613a24 < 31e75fed8f90cfea9f8285e7ed135b0e452bf872`
- `Linux >= 54d2bc068fd21bcb096660938bce7c7265613a24 < 8d53b14ad4ccbff6d306b3a39c812303f4a87d41`
- `Linux >= 54d2bc068fd21bcb096660938bce7c7265613a24 < f62622e947f82a3854a8502d09492ffbdeb252b4`
- `Linux >= 54d2bc068fd21bcb096660938bce7c7265613a24 < 60fc5ef4ecea3e3d1fe556cecf53ddd13096ef09`
- `Linux >= 54d2bc068fd21bcb096660938bce7c7265613a24 < d0f61acb51a8c8f3fd41c303ddb7770cd83e7ed4`
- `Linux >= 54d2bc068fd21bcb096660938bce7c7265613a24 < 54c2b7356b4aeea467f9fb13b85e9e036bc428cb`
- `Linux >= 54d2bc068fd21bcb096660938bce7c7265613a24 < e88cff5fbaa629f3cab45c8b46f395d62c2eb515`
- `Linux >= 54d2bc068fd21bcb096660938bce7c7265613a24 < ff002c153f9722caece3983cc23dc4d9d4652cb4`
- `Linux 2.6.24`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.