CVE-2026-64453 (GCVE-0-2026-64453)
Vulnerability from cvelistv5
Published
2026-07-25 08:51
Modified
2026-08-17 04:55
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: usb: misc: usbio: fix disconnect UAF in client teardown usbio_disconnect() walks usbio->cli_list in reverse and uninitializes each auxiliary device. auxiliary_device_uninit() drops the device reference, and for an unbound child that can run usbio_auxdev_release() and free the containing struct usbio_client. list_for_each_entry_reverse() advances after the loop body by reading client->link.prev. If the current client is freed by auxiliary_device_uninit(), the iterator dereferences freed memory. Use list_for_each_entry_safe_reverse() so the previous client is cached before the body can drop the final reference. This preserves reverse teardown order while keeping the next iterator cursor independent of the current client's lifetime. Validation reproduced this kernel report: BUG: KASAN: slab-use-after-free in usbio_disconnect+0x12e/0x150 Call Trace: <TASK> dump_stack_lvl+0x66/0xa0 print_report+0xce/0x630 ? usbio_disconnect+0x12e/0x150 ? srso_alias_return_thunk+0x5/0xfbef5 ? __virt_addr_valid+0x188/0x320 ? usbio_disconnect+0x12e/0x150 kasan_report+0xe0/0x110 ? usbio_disconnect+0x12e/0x150 usbio_disconnect+0x12e/0x150 usb_unbind_interface+0xf3/0x400 really_probe+0x316/0x660 __driver_probe_device+0x106/0x240 driver_probe_device+0x4a/0x110 __device_attach_driver+0xf1/0x1a0 ? __pfx___device_attach_driver+0x10/0x10 bus_for_each_drv+0xf9/0x160 ? __pfx_bus_for_each_drv+0x10/0x10 ? srso_alias_return_thunk+0x5/0xfbef5 ? trace_hardirqs_on+0x18/0x130 ? srso_alias_return_thunk+0x5/0xfbef5 ? _raw_spin_unlock_irqrestore+0x44/0x60 __device_attach+0x133/0x2a0 ? __pfx___device_attach+0x10/0x10 ? srso_alias_return_thunk+0x5/0xfbef5 ? do_raw_spin_unlock+0x9a/0x100 ? srso_alias_return_thunk+0x5/0xfbef5 device_initial_probe+0x55/0x70 bus_probe_device+0x4a/0xd0 device_add+0x9b9/0xc10 ? __pfx_device_add+0x10/0x10 ? _raw_spin_unlock_irqrestore+0x44/0x60 ? srso_alias_return_thunk+0x5/0xfbef5 ? lockdep_hardirqs_on_prepare+0xea/0x1a0 ? srso_alias_return_thunk+0x5/0xfbef5 ? usb_enable_lpm+0x3c/0x260 usb_set_configuration+0xb64/0xf20 usb_generic_driver_probe+0x5f/0x90 usb_probe_device+0x71/0x1b0 really_probe+0x46b/0x660 __driver_probe_device+0x106/0x240 driver_probe_device+0x4a/0x110 __device_attach_driver+0xf1/0x1a0 ? __pfx___device_attach_driver+0x10/0x10 bus_for_each_drv+0xf9/0x160 ? __pfx_bus_for_each_drv+0x10/0x10 ? srso_alias_return_thunk+0x5/0xfbef5 ? trace_hardirqs_on+0x18/0x130 ? srso_alias_return_thunk+0x5/0xfbef5 ? _raw_spin_unlock_irqrestore+0x44/0x60 __device_attach+0x133/0x2a0 ? __pfx___device_attach+0x10/0x10 ? srso_alias_return_thunk+0x5/0xfbef5 ? do_raw_spin_unlock+0x9a/0x100 ? srso_alias_return_thunk+0x5/0xfbef5 device_initial_probe+0x55/0x70 bus_probe_device+0x4a/0xd0 device_add+0x9b9/0xc10 ? __pfx_device_add+0x10/0x10 ? srso_alias_return_thunk+0x5/0xfbef5 ? add_device_randomness+0xb7/0xf0 usb_new_device+0x492/0x870 hub_event+0x1b10/0x29c0 ? __pfx_hub_event+0x10/0x10 ? srso_alias_return_thunk+0x5/0xfbef5 ? lock_acquire+0x187/0x300 ? process_one_work+0x475/0xb90 ? srso_alias_return_thunk+0x5/0xfbef5 ? lock_release+0xc8/0x290 ? srso_alias_return_thunk+0x5/0xfbef5 process_one_work+0x4d7/0xb90 ? __pfx_process_one_work+0x10/0x10 ? srso_alias_return_thunk+0x5/0xfbef5 ? srso_alias_return_thunk+0x5/0xfbef5 ? __list_add_valid_or_report+0x37/0xf0 ? __pfx_hub_event+0x10/0x10 ? srso_alias_return_thunk+0x5/0xfbef5 worker_thread+0x2d8/0x570 ? __pfx_worker_thread+0x10/0x10 kthread+0x1ad/0x1f0 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x3c9/0x540 ? __pfx_ret_from_fork+0x10/0x10 ? srso_alias_return_thunk+0x5/0xfbef5 ? __switch_to+0x2e9/0x730 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 </TASK>
References
Impacted products
Vendor Product Version
Linux Linux Version: 121a0f839dbb397af5fabb701cea3e9983223e50
Version: 121a0f839dbb397af5fabb701cea3e9983223e50
Version: 121a0f839dbb397af5fabb701cea3e9983223e50
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/misc/usbio.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "c40090f8d19b415e2925b22be964b5d1f695666f",
              "status": "affected",
              "version": "121a0f839dbb397af5fabb701cea3e9983223e50",
              "versionType": "git"
            },
            {
              "lessThan": "1947b6411460d68b54b13c536961933166937d05",
              "status": "affected",
              "version": "121a0f839dbb397af5fabb701cea3e9983223e50",
              "versionType": "git"
            },
            {
              "lessThan": "0bfeec21984fedd32987f4e4c0cde34b445af404",
              "status": "affected",
              "version": "121a0f839dbb397af5fabb701cea3e9983223e50",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/misc/usbio.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.18"
            },
            {
              "lessThan": "6.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.39",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.4",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: misc: usbio: fix disconnect UAF in client teardown\n\nusbio_disconnect() walks usbio-\u003ecli_list in reverse and uninitializes each\nauxiliary device. auxiliary_device_uninit() drops the device reference, and\nfor an unbound child that can run usbio_auxdev_release() and free the\ncontaining struct usbio_client.\n\nlist_for_each_entry_reverse() advances after the loop body by reading\nclient-\u003elink.prev. If the current client is freed by\nauxiliary_device_uninit(), the iterator dereferences freed memory.\n\nUse list_for_each_entry_safe_reverse() so the previous client is\ncached before the body can drop the final reference. This preserves\nreverse teardown order while keeping the next iterator cursor independent\nof the current client\u0027s lifetime.\n\nValidation reproduced this kernel report:\nBUG: KASAN: slab-use-after-free in usbio_disconnect+0x12e/0x150\n\nCall Trace:\n \u003cTASK\u003e\n dump_stack_lvl+0x66/0xa0\n print_report+0xce/0x630\n ? usbio_disconnect+0x12e/0x150\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? __virt_addr_valid+0x188/0x320\n ? usbio_disconnect+0x12e/0x150\n kasan_report+0xe0/0x110\n ? usbio_disconnect+0x12e/0x150\n usbio_disconnect+0x12e/0x150\n usb_unbind_interface+0xf3/0x400\n really_probe+0x316/0x660\n __driver_probe_device+0x106/0x240\n driver_probe_device+0x4a/0x110\n __device_attach_driver+0xf1/0x1a0\n ? __pfx___device_attach_driver+0x10/0x10\n bus_for_each_drv+0xf9/0x160\n ? __pfx_bus_for_each_drv+0x10/0x10\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? trace_hardirqs_on+0x18/0x130\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? _raw_spin_unlock_irqrestore+0x44/0x60\n __device_attach+0x133/0x2a0\n ? __pfx___device_attach+0x10/0x10\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? do_raw_spin_unlock+0x9a/0x100\n ? srso_alias_return_thunk+0x5/0xfbef5\n device_initial_probe+0x55/0x70\n bus_probe_device+0x4a/0xd0\n device_add+0x9b9/0xc10\n ? __pfx_device_add+0x10/0x10\n ? _raw_spin_unlock_irqrestore+0x44/0x60\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? lockdep_hardirqs_on_prepare+0xea/0x1a0\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? usb_enable_lpm+0x3c/0x260\n usb_set_configuration+0xb64/0xf20\n usb_generic_driver_probe+0x5f/0x90\n usb_probe_device+0x71/0x1b0\n really_probe+0x46b/0x660\n __driver_probe_device+0x106/0x240\n driver_probe_device+0x4a/0x110\n __device_attach_driver+0xf1/0x1a0\n ? __pfx___device_attach_driver+0x10/0x10\n bus_for_each_drv+0xf9/0x160\n ? __pfx_bus_for_each_drv+0x10/0x10\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? trace_hardirqs_on+0x18/0x130\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? _raw_spin_unlock_irqrestore+0x44/0x60\n __device_attach+0x133/0x2a0\n ? __pfx___device_attach+0x10/0x10\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? do_raw_spin_unlock+0x9a/0x100\n ? srso_alias_return_thunk+0x5/0xfbef5\n device_initial_probe+0x55/0x70\n bus_probe_device+0x4a/0xd0\n device_add+0x9b9/0xc10\n ? __pfx_device_add+0x10/0x10\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? add_device_randomness+0xb7/0xf0\n usb_new_device+0x492/0x870\n hub_event+0x1b10/0x29c0\n ? __pfx_hub_event+0x10/0x10\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? lock_acquire+0x187/0x300\n ? process_one_work+0x475/0xb90\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? lock_release+0xc8/0x290\n ? srso_alias_return_thunk+0x5/0xfbef5\n process_one_work+0x4d7/0xb90\n ? __pfx_process_one_work+0x10/0x10\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? __list_add_valid_or_report+0x37/0xf0\n ? __pfx_hub_event+0x10/0x10\n ? srso_alias_return_thunk+0x5/0xfbef5\n worker_thread+0x2d8/0x570\n ? __pfx_worker_thread+0x10/0x10\n kthread+0x1ad/0x1f0\n ? __pfx_kthread+0x10/0x10\n ret_from_fork+0x3c9/0x540\n ? __pfx_ret_from_fork+0x10/0x10\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? __switch_to+0x2e9/0x730\n ? __pfx_kthread+0x10/0x10\n ret_from_fork_asm+0x1a/0x30\n \u003c/TASK\u003e"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:55:57.317Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/c40090f8d19b415e2925b22be964b5d1f695666f"
        },
        {
          "url": "https://git.kernel.org/stable/c/1947b6411460d68b54b13c536961933166937d05"
        },
        {
          "url": "https://git.kernel.org/stable/c/0bfeec21984fedd32987f4e4c0cde34b445af404"
        }
      ],
      "title": "usb: misc: usbio: fix disconnect UAF in client teardown",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64453",
    "datePublished": "2026-07-25T08:51:22.478Z",
    "dateReserved": "2026-07-19T15:36:31.789Z",
    "dateUpdated": "2026-08-17T04:55:57.317Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.