VulnerabilityPublished 25 Jul 2026Updated 30 Oct 2026

CVE-2026-64345: Linux kernel · usb: gadget: f_printer: take kref only for successful open

Affects Linux kernelSource CVE Database V5

Compare

Not known to be exploited · fixed in bf20c94fa6aaff945f0ae3a23f3212cd299f28d9 : update Linux kernel when convenient.

Data as of 30 Oct 2026, 13:33 UTC

Severity

Medium

Rated Medium by Threat Radar's AI analysis · No CVSS score from NVD or the CNA

Thin evidence

One scorer or none

Patch: Available – fixed in bf20c94fa6aaff945f0ae3a23f3212cd299f28d9, a12d81a9cc2a012a24ecb7f9ba076b9f7c179bd3, 94ec20d97aa51547965a539f660a1fe79c6929a3 +11

Exploitation evidence

Disclosed: evidence found.
CVE published 25 Jul 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 30 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected >=4.4.241 <4.5 >=4.9.241 <4.10 >=4.14.203 <4.15 >=4.19.154 <4.20 >=5.4.73 <5.5 >=5.8.17 <5.9 >=5.9.2 <5.10	Fixed in bf20c94fa6aaff945f0ae3a23f3212cd299f28d9 a12d81a9cc2a012a24ecb7f9ba076b9f7c179bd3 94ec20d97aa51547965a539f660a1fe79c6929a3 75c0ad13e136961328253742501b4efc3988a587 30adce93d5c4a5a1ec29d9249e3fdfcc391d406b 8a5eba992c862b0c94411eecf9b7121e8636db38 7f1f24c367938c5537e2308bf9a965f051d14774 5.10 5.9 5.5 4.20 4.15 4.10 4.5
LinuxLinux	Affected =5.10	Fixed in–

AI-suggested

A fix is available and has been applied in Linux kernel versions 5.5, 5.9, 5.10, and corresponding stable branches. Users and administrators should update to these fixed versions or later to remediate the issue. No additional mitigation steps are required beyond applying the official patches.

Description

A reference count leak vulnerability exists in the Linux kernel's USB gadget printer function due to improper handling of the kref increment on failed device open attempts. This flaw causes a permanent reference leak when the character device is already open, as the kernel increments the reference count even when open fails, leading to resource leakage. The issue has been fixed by moving the kref increment into the successful open branch.

Impact

The vulnerability causes a permanent reference count leak in the kernel when multiple open attempts are made on the USB gadget printer device while it is already open. This can lead to resource exhaustion in the kernel, potentially degrading system stability or causing denial of service conditions over time. There is no indication of direct code execution or privilege escalation from this flaw.

Summary

In the Linux kernel USB gadget printer function (f_printer), the printer_open() function incorrectly increments the device's reference count (kref) regardless of whether the open operation succeeds or fails. Specifically, when printer_open() returns -EBUSY because the device is already open, it still increments dev->kref. Since the virtual file system (VFS) does not call the release function on a failed open, this results in a permanent reference leak for every rejected second open. The fix involves moving the kref_get() call into the branch where the open is successful, preventing the leak.

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 30 Oct 2026, 13:33 UTC

Technical details

References

Community reviews

Related threats