CVE-2026-64343

A flaw was found in the Linux kernel. A race condition exists in the ldusb USB driver where a mutex_unlock() operation can attempt to access a mutex structure after it has been freed. This occurs when the release() and disconnect() functions race, leading to a use-after-free vulnerability. A local attacker could potentially exploit this to cause a system crash, leading to a denial of service.

This vulnerability is rated Moderate because exploitation requires local system access alongside physical or emulated manipulation of specialized hardware, restricting the overall impact to a denial of service (system crash). The affected ldusb driver is built as a dynamically loaded kernel module that remains inactive unless a compatible USB peripheral is attached to the system. Exploiting this race condition requires tightly synchronized local interaction during device disconnection, precluding widespread or remote execution under default configurations.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.