CVE-2026-63906

A flaw was found in the Linux kernel's USB subsystem. Specifically, within the omap2430 driver, a memory resource is prematurely released while still in use, leading to a use-after-free vulnerability. This could allow a local attacker to cause a system crash (denial of service) or potentially execute arbitrary code with elevated privileges.

This vulnerability is rated as Moderate impact because exploitation requires local access and specialized hardware, limiting the blast radius primarily to a local denial of service. The defect resides in the OMAP2430 USB controller driver, which is designed specifically for embedded Texas Instruments platforms. Because this driver is not enabled in supported Red Hat Enterprise Linux configurations, Red Hat products are not affected by this flaw.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.