CVE-2026-64242: usb: gadget: net2280: Fix double free in probe error path
In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: net2280: Fix double free in probe error path
usbinitializegadget() installs gadgetrelease() as the release callback for the embedded gadget device. The struct net2280 instance is therefore released through gadgetrelease() when the gadget device's last reference is dropped.
The probe error path calls net2280remove(), which tears down the partially initialized device and drops the gadget reference with usbputgadget(). Calling kfree(dev) afterwards can free the same object again.
Drop the explicit kfree() and let the gadget device release callback handle the final free. This issue was found by a static analysis tool I am developing.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In the net2280 probe error path, remove the explicit kfree() of the net2280 struct/object and instead let the embedded gadget device's release callback (gadget_release()) perform the final free.
Linux kernel (usb gadget: net2280) Probe error path cleanup = Drop explicit kfree() and rely on gadget device release callback - Compensating control
Ensure the probe error path uses the correct gadget reference teardown sequence so that the gadget device’s final release (via usb_put_gadget()/gadget_release()) handles freeing the partially initialized device rather than freeing it directly in the error path.
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux kernel's USB gadget net2280 driver are the relevant population. The flaw is in that driver's probe failure cleanup path, so exposure depends on reaching a partially initialized probe that fails.
What level of access does an attacker need?
The CVSS vector indicates local access, low attack complexity, and low privileges are required; no user interaction is required. Successful exploitation is rated as having high potential impact on confidentiality, integrity, and availability.
How can I determine whether this has already been triggered?
The affected path occurs when net2280 probe initialization fails. The description does not provide a runtime indicator, log signature, or detection procedure for determining whether the double free has already occurred.