Executive brief
A vulnerability in the Linux kernel's USB driver for LD devices could allow a local attacker to cause a system crash or potentially execute unauthorized code. The issue occurs when a USB device is disconnected at the same time the driver is attempting to release its resources, leading to a memory error. This could impact system stability and availability in environments where these specific USB devices are used.
Technical details
A use-after-free vulnerability exists in the Linux kernel USB ldusb driver (drivers/usb/misc/ldusb.c). The root cause is a race condition between ld_usb_release() and ld_usb_disconnect() where mutex_unlock() may access the mutex structure after the underlying object has been freed. Because mutex_unlock() is non-atomic and may access the lock object after releasing it, it cannot safely manage the lifetime of the driver data structure without additional reference counting. An attacker with local access or the ability to trigger USB disconnect events could exploit this race to cause a kernel panic or potentially achieve local privilege escalation. The fix introduces kref reference counting to ensure the driver data is only freed after all references, including those held during mutex operations, are released.
Affected products
- Linux Linux Kernel 2.6.26 to 5.10.261
Timeline
- 2026-06-22: patched: Initial patch authored by Johan Hovold
- 2026-07-25: disclosed: CVE-2026-64343 published
References
- https://git.kernel.org/stable/c/02ca08fff74cf9b0a3c4d2cacde1c6edeeb95bb4
- https://git.kernel.org/stable/c/19bdfc7b3c179331eafa423d87e1336f43bbfeb8
- https://git.kernel.org/stable/c/2107a4fc8ff1cf1d52f416c1e5cc8e97413a5915
- https://git.kernel.org/stable/c/a3e794136ab5e3ad1e7019175a4b837aec86db4b
- https://git.kernel.org/stable/c/af59829e67e11ba2511a9f8e4b9111afc7d1f550
- https://git.kernel.org/stable/c/d8f69404e1d671326f86d378b9f5bfbd56490e9d
- https://git.kernel.org/stable/c/e5a9bdce4bfd3e2226b5f3df5fb8385d6935ee69