Executive brief
A vulnerability was identified in the Linux kernel's LEGO USB Tower driver. This issue occurs when a device is disconnected while being accessed by the system, potentially causing the operating system to crash or behave unpredictably. This primarily affects systems using specific legacy LEGO USB hardware interfaces.
Technical details
A use-after-free vulnerability exists in drivers/usb/misc/legousbtower.c due to a race condition between the release() and disconnect() functions. The root cause is the use of mutex_unlock() to manage the lifetime of driver data objects; because mutex_unlock() is non-atomic and may access the mutex structure after releasing the lock, it cannot safely be used when the underlying object might be freed by a racing thread. An attacker with physical access could trigger this by disconnecting the USB device while a process is closing the device file. The fix introduces kref reference counting to ensure the driver data is only freed after all references, including the one held during the mutex operation, are released.
Affected products
- Linux Linux Kernel 2.6.25 to 6.9.x
Timeline
- 2026-06-22: patched: Initial fix authored by Johan Hovold
- 2026-07-25: disclosed: CVE-2026-64340 published
References
- https://git.kernel.org/stable/c/0b57e5ddbd89df3bc367463de3d2ca66f99a1a5e
- https://git.kernel.org/stable/c/11d069f85851997b4ea0adf242ed9672dc749b8f
- https://git.kernel.org/stable/c/62fc8eb1b1481051f7bab4aa93d79809053dd09f
- https://git.kernel.org/stable/c/6462de75d2e370c7e74dcfb7b4ae79eb5a6a55ee
- https://git.kernel.org/stable/c/766738ecf2b819e54d38763c8d1c8ae6cff14b39
- https://git.kernel.org/stable/c/9ba62966461a8e3cc593b62c56ec62eb2d80436d
- https://git.kernel.org/stable/c/ab2bfd7bec4f134b377ec42f513e90c35db94160