CVE-2026-64242 Overview
CVE-2026-64242 is a double free vulnerability in the Linux kernel's net2280 USB gadget driver. The flaw resides in the probe error path, where net2280_remove() tears down the partially initialized device and drops the gadget reference via usb_put_gadget(). A subsequent explicit kfree(dev) call can then free the same struct net2280 instance a second time, because usb_initialize_gadget() already installs gadget_release() as the release callback for the embedded gadget device. The issue was identified through static analysis and resolved by removing the redundant kfree() call.
Critical Impact
A double free in kernel memory can corrupt the slab allocator state, enabling potential local privilege escalation or kernel denial of service on systems using the net2280 USB peripheral controller.
Affected Products
- Linux kernel — drivers/usb/gadget/udc/net2280.c USB gadget driver
- Systems using the PLX NET2280 USB peripheral controller
- Multiple stable kernel branches receiving backported fixes across the referenced commits
Discovery Timeline
- 2026-07-24 - CVE-2026-64242 published to NVD
- 2026-07-30 - Last updated in NVD database
Technical Details for CVE-2026-64242
Vulnerability Analysis
The vulnerability is a double free [CWE-415] in the net2280 USB gadget driver's probe error handling. The Linux USB gadget subsystem uses reference-counted device objects. When usb_initialize_gadget() runs, it installs gadget_release() as the release callback on the embedded gadget device. When the last reference is dropped, the release callback frees the enclosing struct net2280 allocation.
The probe error path calls net2280_remove(), which drops the final gadget reference through usb_put_gadget(). At that point, gadget_release() executes and frees the net2280 object. The subsequent explicit kfree(dev) call in the error path then operates on already-freed memory, producing a double free condition.
Root Cause
The root cause is duplicate ownership of the struct net2280 lifetime. The device object is owned by the gadget device's release callback, but the probe error handler also calls kfree() directly. Both paths free the same allocation. The fix removes the explicit kfree() and delegates the final free to gadget_release().
Attack Vector
Triggering the flaw requires the net2280 probe path to fail after usb_initialize_gadget() succeeds. This typically requires physical access to attach a NET2280-based USB peripheral controller or the ability to induce probe failures on an existing device. The double free corrupts kernel slab metadata and can be leveraged for kernel memory corruption. Exploitation code is not publicly available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
No verified public proof-of-concept exists. Refer to the upstream kernel commits listed in the references for the exact patch diff and code context.
Detection Methods for CVE-2026-64242
Indicators of Compromise
- Kernel oops or panic messages referencing net2280, gadget_release, or slab allocator corruption in dmesg
- KASAN (Kernel Address Sanitizer) reports flagging double-free or use-after-free in the net2280 driver call stack
- Unexpected USB gadget probe failures followed by kernel instability on affected hardware
Detection Strategies
- Enable KASAN on test and pre-production kernels to catch the double free during driver probe stress testing
- Monitor kernel logs for BUG: KASAN or slab-out-of-bounds entries correlated with USB gadget driver load events
- Audit deployed kernel versions against the fixed commits published on git.kernel.org to identify unpatched systems
Monitoring Recommendations
- Forward kernel logs from Linux endpoints to a centralized logging pipeline and alert on net2280 fault signatures
- Track USB device attachment events on hosts with NET2280 controllers to correlate probe failures with subsequent crashes
- Include kernel package versions in asset inventory scans to detect systems missing the referenced stable backports
How to Mitigate CVE-2026-64242
Immediate Actions Required
- Apply the upstream kernel patch that removes the redundant kfree(dev) from the net2280 probe error path
- Update to a stable Linux kernel release that incorporates one of the referenced fix commits, such as 085652f or db2b72
- Reboot affected systems after patch installation to load the corrected net2280 driver
Patch Information
The fix is available in multiple stable kernel branches. The patch drops the explicit kfree() in net2280's probe error path so the gadget device's gadget_release() callback performs the single, correct free. Reference commits include 085652fda7f3, 48f89ead20e4, 550fa4d071a8, 71b3391dc816, c5b9fdb1e8dd, c8547c74988e, db2b72e83a02, and e6f8be12f030.
Workarounds
- Blacklist the net2280 kernel module on systems that do not require NET2280 USB peripheral controller support
- Restrict physical access to systems using NET2280 hardware to reduce opportunities to trigger probe failures
- Disable USB gadget functionality in kernel configuration where the peripheral role is not needed
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
