CVE-2026-64344: USB: idmouse: fix use-after-free on disconnect race
In the Linux kernel, the following vulnerability has been resolved:
USB: idmouse: fix use-after-free on disconnect race
mutexunlock() may access the mutex structure after releasing the lock and therefore cannot be used to manage lifetime of objects directly (unlike spinlocks and refcounts). [1][2]
Use a kref to release the driver data to avoid use-after-free in mutexunlock() when release() races with disconnect().
[1] a51749ab34d9 ("locking/mutex: Document that mutexunlock() is non-atomic") [2] 2b9d9e0a9ba0 ("locking/mutex: Clarify that mutexunlock(), and most other sleeping locks, can still use the lock object after it's unlocked")
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Linux kernel (USB: idmouse)to a version that resolves this vulnerability.Patch a51749ab34d9 - Upgrade
Upgrade
Linux kernel (USB: idmouse)to a version that resolves this vulnerability.Patch 2b9d9e0a9ba0
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The CVSS vector indicates local access and low privileges are required. No user interaction is required.
Which systems are potentially exposed?
Linux systems using the kernel's idmouse USB driver are potentially affected, particularly where device release can race with USB disconnect handling.
What impact could successful exploitation have?
The CVSS assessment rates confidentiality, integrity, and availability impact as high. The underlying flaw is a use-after-free condition caused by a disconnect race.