Executive brief
A vulnerability in the Linux kernel's USB printer gadget driver could allow a local user to cause a memory leak. By repeatedly attempting to open a device that is already in use, an attacker can exhaust system resources over time. This could eventually lead to system instability or a denial-of-service condition.
Technical details
A reference count leak exists in the 'printer_open' function within 'drivers/usb/gadget/function/f_printer.c'. The function increments the 'dev->kref' reference counter before checking if the device is already busy. If the device is busy, it returns -EBUSY, but because the VFS layer does not call the release function for failed opens, the reference is never decremented. A local attacker can exploit this by repeatedly attempting to open an already-open printer gadget device, leading to a permanent kernel memory leak. The issue has been resolved by moving the 'kref_get' call into the successful-open code path.
Affected products
- Linux Linux Kernel 4.4.241, 4.9.241, 4.14.203, 4.19.154, and others prior to 6.10.y/6.11.y stable updates
Timeline
- 2026-06-26: other: Initial patch authored
- 2026-07-08: patched: Patch committed to stable tree
- 2026-07-25: disclosed: CVE published
References
- https://git.kernel.org/stable/c/30adce93d5c4a5a1ec29d9249e3fdfcc391d406b
- https://git.kernel.org/stable/c/75c0ad13e136961328253742501b4efc3988a587
- https://git.kernel.org/stable/c/7f1f24c367938c5537e2308bf9a965f051d14774
- https://git.kernel.org/stable/c/8a5eba992c862b0c94411eecf9b7121e8636db38
- https://git.kernel.org/stable/c/94ec20d97aa51547965a539f660a1fe79c6929a3
- https://git.kernel.org/stable/c/bf20c94fa6aaff945f0ae3a23f3212cd299f28d9