PT-2026-64357 · Linux · Linux

CVE-2026-64242 · Published 2026-07-24 · Updated 2026-07-24

Mitre

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: net2280: Fix double free in probe error path

usb initialize gadget() installs gadget release() as the release callback for the embedded gadget device. The struct net2280 instance is therefore released through gadget release() when the gadget device's last reference is dropped.

The probe error path calls net2280 remove(), which tears down the partially initialized device and drops the gadget reference with usb put gadget(). Calling kfree(dev) afterwards can free the same object again.

Drop the explicit kfree() and let the gadget device release callback handle the final free. This issue was found by a static analysis tool I am developing.

Related Identifiers

CVE-2026-64242

Affected Products

Linux

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2026-64242 · Security Note
• https://git.kernel.org/stable/c/48f89ead20e48d447ad29fa937b43b9fa981cf28 · Note
• https://git.kernel.org/stable/c/c5b9fdb1e8ddf50bc6272927edb118679f170350 · Note
• https://git.kernel.org/stable/c/550fa4d071a8c8e53072900869d37ae6abf4999d · Note
• https://git.kernel.org/stable/c/e6f8be12f0307145b9a6010f044925952b37de8b · Note
• https://git.kernel.org/stable/c/c8547c74988e0b5f4cbb1b895e2a57aae084f070 · Note
• https://git.kernel.org/stable/c/db2b72e83a0208ae2b3b270bf91662b1c6849a9b · Note
• https://git.kernel.org/stable/c/085652fda7f38040d1a2c42d72614f418feb843f · Note
• https://git.kernel.org/stable/c/71b3391dc81655ff058492f8e9d013b2c6e5747b · Note