CVE-2026-64344

A flaw was found in the Linux kernel's USB idmouse driver. A local attacker could exploit a use-after-free vulnerability due to a race condition that occurs when a USB idmouse device is disconnected. This race condition allows mutex_unlock() to access freed memory, which can lead to a system crash and result in a denial of service.

USB idmouse has a disconnect race where idmouse_release() and idmouse_disconnect() can drop the last reference while mutex_unlock() may still access the mutex object after the unlock operation. This is a use-after-free candidate in driver private data lifetime handling and can cause a kernel crash. For the CVSS the PR:L is used because a local user or process needs access to the idmouse character device or an equivalent local device context to race release with USB disconnect. The issue is not network reachable and requires a local or physical USB device scenario. Impact is at least local denial of service via kernel crash and in the paranoid case may include confidentiality or integrity impact because the freed driver object contains a mutex and other fields that can be accessed after free.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.