CVE-2026-64338: Linux Kernel Privilege Escalation Flaw

CVE-2026-64338 Overview

CVE-2026-64338 is a Linux kernel vulnerability in the uss720 USB-to-parallel-port driver. The flaw resides in uss720_probe(), which registers a parport device before probing the IEEE 1284 register used to detect unsupported Belkin F5U002 adapters. When get_1284_register() fails, the error path releases the driver private data and drops the USB device reference but leaves the parport device registered. The registered parport retains a private_data pointer that references memory the common cleanup path is about to free.

Critical Impact
A failed probe leaves a registered parport bus device holding a stale private_data pointer, creating a use-after-free condition reachable from parport subsystem consumers.

Affected Products

Linux kernel drivers/usb/misc/uss720.c (USS720-based USB-to-parallel-port adapters)
Systems using the uss720 driver with attached USB parallel-port devices
Multiple stable kernel branches (see referenced kernel patches)

Discovery Timeline

2026-07-25 - CVE-2026-64338 published to NVD
2026-07-25 - Last updated in NVD database

Technical Details for CVE-2026-64338

Vulnerability Analysis

The uss720_probe() function in the Linux kernel USB miscellaneous driver stack initializes a parport instance to represent the USB-to-parallel-port bridge. Registration happens through parport_register_port(), which reserves a parport number and registers the parport bus device before probing continues.

After registration, the driver calls get_1284_register() to read the IEEE 1284 status register. This read distinguishes supported USS720 hardware from unsupported Belkin F5U002 adapters. When this read fails, the original error path frees the driver private data and drops the USB device reference but never calls parport_unregister_port().

The registered parport therefore survives with pp->private_data still pointing at freed memory. Any subsequent access from parport consumers dereferences a stale pointer, which can lead to memory corruption or a kernel oops [CWE-416].

Root Cause

The root cause is incomplete rollback in an error path. The probe function performs two allocation-style operations, parport registration and private-data population, but the failure branch reverses only one. The fix, distributed across kernel stable trees including 0b3073f40cc9, 48dd0b2ec9f2, and b4ecbdc4f883, clears priv->pp first and then unregisters the parport before jumping to the shared private-data cleanup label, matching the ordering used by the disconnect path.

Attack Vector

Triggering the flaw requires a USB device that presents the USS720 device identifier and induces get_1284_register() to return an error. A crafted or malicious USB peripheral can force the probe path down the failing branch. Physical or supply-chain access to attach such a device is required, so exploitation is local and depends on kernel automatic driver binding. The EPSS score is 0.177% at the 7.456 percentile, reflecting low expected exploitation activity.

No verified public exploitation code exists. See the referenced kernel patch 0b3073f40cc9 for the source-level diff.

Detection Methods for CVE-2026-64338

Indicators of Compromise

Kernel log entries from the uss720 driver reporting get_1284_register failures followed by later parport subsystem oops or slab-use-after-free reports.
KASAN or KFENCE reports referencing pp->private_data accesses originating in the parport core after a failed USB probe.
Unexpected parportN device nodes remaining after a USB device unbind event on systems using USB-to-parallel adapters.

Detection Strategies

Enable CONFIG_KASAN on test kernels to surface the use-after-free at the point of dereference rather than at a downstream crash.
Monitor dmesg for the sequence of uss720 probe failure messages followed by parport registration without a matching unregister.
Audit installed kernel package versions against the fixed commits published on git.kernel.org stable trees.

Monitoring Recommendations

Forward kernel ring buffer messages to a centralized log platform and alert on uss720 probe errors correlated with parport activity.
Inventory hosts that load the uss720 module using lsmod telemetry from endpoint agents to scope exposure.
Track USB device insertion events on servers and workstations where USB-to-parallel adapters are not part of the expected hardware baseline.

How to Mitigate CVE-2026-64338

Immediate Actions Required

Update to a Linux kernel release that includes one of the referenced fix commits such as 0b3073f40cc9, 1712fd71a5aa, 48dd0b2ec9f2, 5e62d7857fd5, 6bbb98bec71b, 729b68a5bad7, 93563243377f, or b4ecbdc4f883.
Rebuild custom kernels against the patched drivers/usb/misc/uss720.c before redeployment.
Restrict physical and USB port access on systems where the uss720 driver is loaded and USB parallel adapters are not required.

Patch Information

The fix updates uss720_probe() so that when get_1284_register() fails, the driver first clears priv->pp and then calls parport_unregister_port() before jumping to the common private-data cleanup path. This ordering mirrors the disconnect path and eliminates the stale private_data pointer. Patched commits are available across supported stable branches through git.kernel.org, including kernel patch 48dd0b2ec9f2 and kernel patch 93563243377f.

Workarounds

Blocklist the uss720 module with install uss720 /bin/true in /etc/modprobe.d/ on systems that do not require USB-to-parallel functionality.
Unload the module with modprobe -r uss720 where it is currently loaded but unused.
Apply USB device policies via udev rules to prevent auto-binding of USS720-class devices on hosts pending kernel updates.

bash

# Configuration example
# Disable the uss720 driver on hosts that do not need USB-to-parallel support
echo 'install uss720 /bin/true' | sudo tee /etc/modprobe.d/blacklist-uss720.conf
sudo modprobe -r uss720 2>/dev/null || true

# Verify the module is no longer loaded
lsmod | grep uss720 || echo 'uss720 not loaded'