In the Linux kernel, the following vulnerability has been resolved: USB: misc: uss720: unregister parport on probe failure uss720_probe() registers… (CVE-2026-64338)
Source GCVE Database
No CVSS score published yet
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.1% chance of exploitation in 30 days – higher than 1% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
What to do
AI-suggested
A fix has been applied to the Linux kernel to unregister the parport device on probe failure in the uss720 driver, preventing stale pointers and resource leaks. Users should apply the official kernel updates containing this patch when available. Patch status is not explicitly confirmed in the provided data; check the vendor or kernel mailing lists for the specific patch and update guidance.
Description
In the Linux kernel, the following vulnerability has been resolved: USB: misc: uss720: unregister parport on probe failure uss720_probe() registers a parport before reading the 1284 register used to detect unsupported Belkin F5U002 adapters. If get_1284_register() fails, the error path drops the driver private data and the USB device reference, but leaves the parport device registered. Leaving the port registered is more than a private allocation leak: parport_register_port() has already reserved a parport number and registered the parport bus device, while pp->private_data still points at the private data that the common error path is about to release. Undo the pre-announce registration in the get_1284_register() failure branch before jumping to the common private-data cleanup path. Clear priv->pp first, matching the disconnect path and avoiding a stale pointer in the private data. This issue was identified during our ongoing static-analysis research while reviewing kernel code.
Impact
The vulnerability results in resource leaks and stale pointers within the kernel's USB subsystem for affected devices. While no direct exploitation or remote code execution is indicated, the inconsistent device state could cause kernel instability or crashes. There are no known exploits in the wild.
Summary
The Linux kernel uss720 USB misc driver had a flaw where the probe function registered a parport device before confirming device compatibility via the 1284 register. On failure to read this register, the driver would drop private data and USB references but fail to unregister the parport device, leaving it registered with pointers to freed data. This could lead to resource leaks and potential instability. The patch corrects this by unregistering the parport device on probe failure and clearing private data pointers to avoid stale references.
References
- nvd.nist.gov/vuln/detail/CVE-2026-64338 (opens in a new tab)
- git.kernel.org/stable/c/0b3073f40cc9f95d5ff0037eb0a06f5c1725a7ea (opens in a new tab)
- git.kernel.org/stable/c/1712fd71a5aaf81e47c747f180535fa963ad7830 (opens in a new tab)
- git.kernel.org/stable/c/48dd0b2ec9f2e97c486eb68cd0a64b25c1c3df3e (opens in a new tab)
- git.kernel.org/stable/c/5e62d7857fd51b908b8371062ee839739a086bbe (opens in a new tab)
- git.kernel.org/stable/c/6bbb98bec71b577fda4f4b48f7aea5874b04a576 (opens in a new tab)
- git.kernel.org/stable/c/729b68a5bad71220ae0914c8bdab9488ad5be6c8 (opens in a new tab)
- git.kernel.org/stable/c/93563243377f8e9b46cc94d9c4f06533dd31b141 (opens in a new tab)
- git.kernel.org/stable/c/b4ecbdc4f8830f5586c4a5cfc384c00f20f8f8b3 (opens in a new tab)