CVE-2026-64242: usb: gadget: net2280: Fix double free in probe error path

Published Jul 24, 2026
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: net2280: Fix double free in probe error path

usbinitializegadget() installs gadgetrelease() as the release callback for the embedded gadget device. The struct net2280 instance is therefore released through gadgetrelease() when the gadget device's last reference is dropped.

The probe error path calls net2280remove(), which tears down the partially initialized device and drops the gadget reference with usbputgadget(). Calling kfree(dev) afterwards can free the same object again.

Drop the explicit kfree() and let the gadget device release callback handle the final free. This issue was found by a static analysis tool I am developing.

Affected Software

13 affected components
Linux Kernel
Linux Linux kernel>=5.10<5.10.259
Linux Linux kernel>=5.11<5.15.210
Linux Linux kernel>=5.16<6.1.176
Linux Linux kernel>=6.2<6.6.143
Linux Linux kernel>=6.7<6.12.93
Linux Linux kernel>=6.13<6.18.35
Linux Linux kernel>=6.19<7.0.12
Linux Linux kernel=7.1-rc1
Linux Linux kernel=7.1-rc2
Linux Linux kernel=7.1-rc3
Linux Linux kernel=7.1-rc4
Linux Linux kernel=7.1-rc5

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Configuration

    In the net2280 probe error path, remove the explicit kfree() of the net2280 struct/object and instead let the embedded gadget device's release callback (gadget_release()) perform the final free.

    Linux kernel (usb gadget: net2280) Probe error path cleanup = Drop explicit kfree() and rely on gadget device release callback
  2. Compensating control

    Ensure the probe error path uses the correct gadget reference teardown sequence so that the gadget device’s final release (via usb_put_gadget()/gadget_release()) handles freeing the partially initialized device rather than freeing it directly in the error path.

Event History

Jul 24, 2026
CVE Published
via MITRE·03:27 PM
Data Sourced
via MITRE·03:27 PM
Description
Data Sourced
via NVD·04:16 PM
RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

1

Which systems are exposed to this issue?

Systems using the Linux kernel's USB gadget net2280 driver are the relevant population. The flaw is in that driver's probe failure cleanup path, so exposure depends on reaching a partially initialized probe that fails.

2

What level of access does an attacker need?

The CVSS vector indicates local access, low attack complexity, and low privileges are required; no user interaction is required. Successful exploitation is rated as having high potential impact on confidentiality, integrity, and availability.

3

How can I determine whether this has already been triggered?

The affected path occurs when net2280 probe initialization fails. The description does not provide a runtime indicator, log signature, or detection procedure for determining whether the double free has already occurred.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203