In the Linux kernel, the following vulnerability has been resolved: USB: iowarrior: fix use-after-free on disconnect Submitted write URBs are not… (CVE-2026-64342)
Source GCVE Database
No CVSS score published yet
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.1% chance of exploitation in 30 days – higher than 2% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
What to do
AI-suggested
A fix for this vulnerability has been implemented in the Linux kernel. Users and administrators should apply the official kernel updates that include this patch to remediate the issue. Since this is a kernel-level vulnerability, updating to a fixed kernel version is the recommended mitigation.
Description
In the Linux kernel, the following vulnerability has been resolved: USB: iowarrior: fix use-after-free on disconnect Submitted write URBs are not stopped on close() and therefore need to be stopped unconditionally on disconnect() to avoid use-after-free in the completion handler.
Impact
The vulnerability could lead to use-after-free conditions in kernel memory, which may cause system instability or potential escalation of privileges if exploited. However, no known exploits are reported in the wild at this time.
Summary
The Linux kernel USB iowarrior driver contained a use-after-free vulnerability triggered when submitted write URBs were not stopped upon close(), causing them to remain active and potentially accessed after the device disconnects. The fix involves stopping these URBs unconditionally during the disconnect process to prevent use-after-free conditions in the completion handler.
References
- nvd.nist.gov/vuln/detail/CVE-2026-64342 (opens in a new tab)
- git.kernel.org/stable/c/164398601a7f160bc3df1efa454f983302cef03f (opens in a new tab)
- git.kernel.org/stable/c/97ad9337127be04ca0b027c2b01e69302353f404 (opens in a new tab)
- git.kernel.org/stable/c/a7bbe946ca3a6eeb6f364d5e84b05e02c7c0d595 (opens in a new tab)
- git.kernel.org/stable/c/b748f97aff339e7f08dca9cf38a05b980fb66fea (opens in a new tab)
- git.kernel.org/stable/c/bc0e4f16c44e50daa0b1ea729934baa3b4815dee (opens in a new tab)
- git.kernel.org/stable/c/d058d377291567b72aea33b017215cbfb383b0ad (opens in a new tab)
- git.kernel.org/stable/c/e4596816984efc537e7c04c1af0c639394f967f7 (opens in a new tab)
- git.kernel.org/stable/c/f328b0e9a0dbd162f5db1b83026b689f2fea2241 (opens in a new tab)