CVE-2026-64343: USB: ldusb: fix use-after-free on disconnect race
In the Linux kernel, the following vulnerability has been resolved:
USB: ldusb: fix use-after-free on disconnect race
mutexunlock() may access the mutex structure after releasing the lock and therefore cannot be used to manage lifetime of objects directly (unlike spinlocks and refcounts). [1][2]
Use a kref to release the driver data to avoid use-after-free in mutexunlock() when release() races with disconnect().
[1] a51749ab34d9 ("locking/mutex: Document that mutexunlock() is non-atomic") [2] 2b9d9e0a9ba0 ("locking/mutex: Clarify that mutexunlock(), and most other sleeping locks, can still use the lock object after it's unlocked")
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Apply the resolved kernel change for "USB: ldusb: fix use-after-free on disconnect race" by updating the ldusb driver to use a kref to release driver data, avoiding use-after-free when release() races with disconnect().
Linux kernel (USB: ldusb) Implement driver-data lifetime management using kref to fix use-after-free on disconnect race = kref-based release of driver data
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The CVSS vector indicates local attack access and low privileges are required. No user interaction is required.
What conditions trigger the vulnerable race?
The issue occurs when the ldusb driver's release() path races with USB device disconnect handling, allowing use-after-free during mutex_unlock(). Systems using the affected ldusb driver are the relevant exposure scope described.
What is the impact if exploited?
The CVSS rating is 7.8 High, with high impact to confidentiality, integrity, and availability. The scope is unchanged according to the provided vector.
Is there a fix available?
Yes. The vulnerability is described as resolved by changing driver-data lifetime management to use a kref, preventing the release/disconnect race from freeing data while it may still be accessed.