In the Linux kernel, the following vulnerability has been resolved: USB: misc: uss720: unregister parport on probe failure uss720_probe() registers… (CVE-2026-64338)
In the Linux kernel, the following vulnerability has been resolved: USB: misc: uss720: unregister parport on probe failure uss720_probe() registers a parport before reading the 1284 register used to detect unsupported Belkin F5U002 adapters. If get_1284_register() fails, the error path drops the driver private data and the USB device reference, but leaves the parport device registered. Leaving the port registered is more than a private allocation leak: parport_register_port() has already reserved a parport number and registered the parport bus device, while pp->private_data still points at the private data that the common error path is about to release. Undo the pre-announce registration in the get_1284_register() failure branch before jumping to the common private-data cleanup path. Clear priv->pp first, matching the disconnect path and avoiding a stale pointer in the private data. This issue was identified during our ongoing static-analysis research while reviewing kernel code.
AI Analysis
Technical Summary
The Linux kernel uss720 USB misc driver had a flaw where the probe function registered a parport device before confirming device compatibility via the 1284 register. On failure to read this register, the driver would drop private data and USB references but fail to unregister the parport device, leaving it registered with pointers to freed data. This could lead to resource leaks and potential instability. The patch corrects this by unregistering the parport device on probe failure and clearing private data pointers to avoid stale references.
Potential Impact
The vulnerability results in resource leaks and stale pointers within the kernel's USB subsystem for affected devices. While no direct exploitation or remote code execution is indicated, the inconsistent device state could cause kernel instability or crashes. There are no known exploits in the wild.
Mitigation Recommendations
A fix has been applied to the Linux kernel to unregister the parport device on probe failure in the uss720 driver, preventing stale pointers and resource leaks. Users should apply the official kernel updates containing this patch when available. Patch status is not explicitly confirmed in the provided data; check the vendor or kernel mailing lists for the specific patch and update guidance.
In the Linux kernel, the following vulnerability has been resolved: USB: misc: uss720: unregister parport on probe failure uss720_probe() registers… (CVE-2026-64338)
Description
In the Linux kernel, the following vulnerability has been resolved: USB: misc: uss720: unregister parport on probe failure uss720_probe() registers a parport before reading the 1284 register used to detect unsupported Belkin F5U002 adapters. If get_1284_register() fails, the error path drops the driver private data and the USB device reference, but leaves the parport device registered. Leaving the port registered is more than a private allocation leak: parport_register_port() has already reserved a parport number and registered the parport bus device, while pp->private_data still points at the private data that the common error path is about to release. Undo the pre-announce registration in the get_1284_register() failure branch before jumping to the common private-data cleanup path. Clear priv->pp first, matching the disconnect path and avoiding a stale pointer in the private data. This issue was identified during our ongoing static-analysis research while reviewing kernel code.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Linux kernel uss720 USB misc driver had a flaw where the probe function registered a parport device before confirming device compatibility via the 1284 register. On failure to read this register, the driver would drop private data and USB references but fail to unregister the parport device, leaving it registered with pointers to freed data. This could lead to resource leaks and potential instability. The patch corrects this by unregistering the parport device on probe failure and clearing private data pointers to avoid stale references.
Potential Impact
The vulnerability results in resource leaks and stale pointers within the kernel's USB subsystem for affected devices. While no direct exploitation or remote code execution is indicated, the inconsistent device state could cause kernel instability or crashes. There are no known exploits in the wild.
Mitigation Recommendations
A fix has been applied to the Linux kernel to unregister the parport device on probe failure in the uss720 driver, preventing stale pointers and resource leaks. Users should apply the official kernel updates containing this patch when available. Patch status is not explicitly confirmed in the provided data; check the vendor or kernel mailing lists for the specific patch and update guidance.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-pghr-8xhx-xv5x
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-64338"]
- Ecosystems
- []
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a65420b9c2644c7f8084d69
Added to database: 07/25/2026, 23:08:59 UTC
Last enriched: 07/25/2026, 23:31:27 UTC
Last updated: 09/08/2026, 22:52:14 UTC
Views: 50
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.