CVE-2026-64342: USB: iowarrior: fix use-after-free on disconnect
In the Linux kernel, the following vulnerability has been resolved:
USB: iowarrior: fix use-after-free on disconnect
Submitted write URBs are not stopped on close() and therefore need to be stopped unconditionally on disconnect() to avoid use-after-free in the completion handler.
Affected Software
Remediation
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems using the Linux kernel with the USB iowarrior driver are exposed when submitted write URBs remain active as an iowarrior device disconnects.
What level of access does an attacker need?
The CVSS vector identifies local attack access and low privileges, with no user interaction required. Exploitation is associated with triggering device disconnect handling while write URBs are still submitted.
What is the impact if exploited?
The issue is a use-after-free condition in a completion handler. The reported CVSS vector rates confidentiality, integrity, and availability impacts as high.
What should be done if patching cannot happen immediately?
The provided fix stops submitted write URBs unconditionally during disconnect handling. Until the patch is applied, reducing use of the affected iowarrior USB driver and avoiding device disconnects while write URBs are active can reduce exposure.