PT-2026-64674 · Linux · Linux
CVE-2026-64453
·
Published
2026-07-25
·
Updated
2026-07-25
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
usb: misc: usbio: fix disconnect UAF in client teardown
usbio disconnect() walks usbio->cli list in reverse and uninitializes each
auxiliary device. auxiliary device uninit() drops the device reference, and
for an unbound child that can run usbio auxdev release() and free the
containing struct usbio client.
list for each entry reverse() advances after the loop body by reading
client->link.prev. If the current client is freed by
auxiliary device uninit(), the iterator dereferences freed memory.
Use list for each entry safe reverse() so the previous client is
cached before the body can drop the final reference. This preserves
reverse teardown order while keeping the next iterator cursor independent
of the current client's lifetime.
Validation reproduced this kernel report:
BUG: KASAN: slab-use-after-free in usbio disconnect+0x12e/0x150
Call Trace:
dump stack lvl+0x66/0xa0
print report+0xce/0x630
? usbio disconnect+0x12e/0x150
? srso alias return thunk+0x5/0xfbef5
? virt addr valid+0x188/0x320
? usbio disconnect+0x12e/0x150
kasan report+0xe0/0x110
? usbio disconnect+0x12e/0x150
usbio disconnect+0x12e/0x150
usb unbind interface+0xf3/0x400
really probe+0x316/0x660
driver probe device+0x106/0x240
driver probe device+0x4a/0x110
device attach driver+0xf1/0x1a0
? pfx device attach driver+0x10/0x10
bus for each drv+0xf9/0x160
? pfx bus for each drv+0x10/0x10
? srso alias return thunk+0x5/0xfbef5
? trace hardirqs on+0x18/0x130
? srso alias return thunk+0x5/0xfbef5
? raw spin unlock irqrestore+0x44/0x60
device attach+0x133/0x2a0
? pfx device attach+0x10/0x10
? srso alias return thunk+0x5/0xfbef5
? do raw spin unlock+0x9a/0x100
? srso alias return thunk+0x5/0xfbef5
device initial probe+0x55/0x70
bus probe device+0x4a/0xd0
device add+0x9b9/0xc10
? pfx device add+0x10/0x10
? raw spin unlock irqrestore+0x44/0x60
? srso alias return thunk+0x5/0xfbef5
? lockdep hardirqs on prepare+0xea/0x1a0
? srso alias return thunk+0x5/0xfbef5
? usb enable lpm+0x3c/0x260
usb set configuration+0xb64/0xf20
usb generic driver probe+0x5f/0x90
usb probe device+0x71/0x1b0
really probe+0x46b/0x660
driver probe device+0x106/0x240
driver probe device+0x4a/0x110
device attach driver+0xf1/0x1a0
? pfx device attach driver+0x10/0x10
bus for each drv+0xf9/0x160
? pfx bus for each drv+0x10/0x10
? srso alias return thunk+0x5/0xfbef5
? trace hardirqs on+0x18/0x130
? srso alias return thunk+0x5/0xfbef5
? raw spin unlock irqrestore+0x44/0x60
device attach+0x133/0x2a0
? pfx device attach+0x10/0x10
? srso alias return thunk+0x5/0xfbef5
? do raw spin unlock+0x9a/0x100
? srso alias return thunk+0x5/0xfbef5
device initial probe+0x55/0x70
bus probe device+0x4a/0xd0
device add+0x9b9/0xc10
? pfx device add+0x10/0x10
? srso alias return thunk+0x5/0xfbef5
? add device randomness+0xb7/0xf0
usb new device+0x492/0x870
hub event+0x1b10/0x29c0
? pfx hub event+0x10/0x10
? srso alias return thunk+0x5/0xfbef5
? lock acquire+0x187/0x300
? process one work+0x475/0xb90
? srso alias return thunk+0x5/0xfbef5
? lock release+0xc8/0x290
? srso alias return thunk+0x5/0xfbef5
process one work+0x4d7/0xb90
? pfx process one work+0x10/0x10
? srso alias return thunk+0x5/0xfbef5
? srso alias return thunk+0x5/0xfbef5
? list add valid or report+0x37/0xf0
? pfx hub event+0x10/0x10
? srso alias return thunk+0x5/0xfbef5
worker thread+0x2d8/0x570
? pfx worker thread+0x10/0x10
kthread+0x1ad/0x1f0
? pfx kthread+0x10/0x10
ret from fork+0x3c9/0x540
? pfx ret from fork+0x10/0x10
? srso alias return thunk+0x5/0xfbef5
? switch to+0x2e9/0x730
? pfx kthread+0x10/0x10
ret from fork asm+0x1a/0x30
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux