CVE-2026-64453

A flaw was found in the Linux kernel's USB subsystem, specifically within the usbio module. This vulnerability, known as a use-after-free (UAF), occurs when the system attempts to access memory that has already been released during the disconnection of a USB device. A local attacker or a specially crafted malicious USB device could exploit this flaw. Successful exploitation could lead to a system crash (denial of service) or potentially allow for the execution of unauthorized code.

A use-after-free can occur in the USBIO disconnect path because usbio_disconnect iterates the client list with a non safe reverse iterator while auxiliary_device_uninit can drop the final reference and free the current usbio_client. After the loop body returns, the iterator may read the previous list pointer from freed memory and trigger a KASAN slab-use-after-free or kernel crash. For the CVSS the PR:N value is used for the paranoid score because a physical attacker with access to the USB port may trigger the vulnerable disconnect path without a local account. The issue is not network reachable and requires the affected USBIO driver and a matching device or teardown path. Impact is at least denial of service via kernel crash and in worst case may allow confidentiality or integrity impact due to kernel UAF memory corruption.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.