CVE-2026-64340: Linux Kernel Use-After-Free Vulnerability

CVE-2026-64340 Overview

CVE-2026-64340 is a use-after-free vulnerability in the Linux kernel's legousbtower USB driver. The flaw occurs when the driver's release() function races with disconnect(), causing mutex_unlock() to access the mutex structure after the driver data has been freed. Because mutex_unlock() may touch the mutex object after releasing the lock, it cannot be safely used to manage object lifetime the way spinlocks or refcounts can. The upstream fix introduces a kref to properly manage the driver data lifetime and prevent the race condition.

Critical Impact
A local attacker with the ability to trigger USB disconnect events while a userspace process holds an open file descriptor to a legousbtower device could trigger memory corruption in kernel space, potentially leading to denial of service or privilege escalation.

Affected Products

Linux kernel drivers/usb/misc/legousbtower.c driver
Multiple stable kernel branches (see referenced commits)
Systems exposing the LEGO USB Tower device interface to userspace

Discovery Timeline

2026-07-25 - CVE-2026-64340 published to NVD
2026-07-25 - Last updated in NVD database

Technical Details for CVE-2026-64340

Vulnerability Analysis

The vulnerability resides in the legousbtower USB character driver, which exposes LEGO Mindstorms tower devices to userspace through a file interface. When the device is disconnected while a userspace program still holds an open file descriptor, the kernel must coordinate between the disconnect() callback and the file release() handler. The original code relied on a mutex to serialize teardown, but mutex_unlock() on Linux is documented as non-atomic and may access the mutex structure after the lock is released. If disconnect() frees the driver data structure that embeds the mutex while release() is executing mutex_unlock(), the unlock operation dereferences freed memory [CWE-416].

Root Cause

The root cause is an incorrect assumption about mutex lifetime semantics. Unlike spinlocks and reference counters, mutex_unlock() in the Linux kernel may touch the mutex object after releasing the lock, as clarified by commits a51749ab34d9 and 2b9d9e0a9ba0. Using a mutex embedded in a dynamically freed structure to serialize free-versus-use paths therefore introduces a use-after-free window. The upstream patch replaces the mutex-only lifetime scheme with a kref reference count that safely tracks all outstanding references to the driver data.

Attack Vector

Exploitation requires local access and the ability to trigger a USB disconnect event on a legousbtower device while a process holds the device file open. On systems that automatically bind the driver to matching devices, an attacker with physical access or control of a virtual USB gadget could race close() against device removal. The resulting use-after-free could corrupt slab memory, causing kernel crashes or, with additional heap-grooming primitives, potentially escalating privileges. See the Linux Kernel Commit Log for the reference implementation of the fix.

Detection Methods for CVE-2026-64340

Indicators of Compromise

Kernel oops or panic messages referencing legousbtower, mutex_unlock, or slab-use-after-free reports from KASAN.
Unexpected kernel crashes correlated with USB device removal events in dmesg or journalctl -k.
Repeated hotplug events from unusual USB vendor/product IDs matching the LEGO Tower device.

Detection Strategies

Enable KASAN (Kernel Address Sanitizer) on test and staging kernels to surface the use-after-free at runtime.
Audit installed kernel packages against the fixed commit hashes referenced in the Linux Kernel Commit Log entries for this CVE.
Monitor for the presence of the legousbtower module on production systems and flag hosts where it is loaded but not required.

Monitoring Recommendations

Collect kernel logs centrally and alert on BUG: or general protection fault messages referencing USB drivers.
Track USB device connection and disconnection events via udev or auditd USB rules on multi-user hosts.
Include kernel version and loaded module inventory in host telemetry to identify unpatched systems at scale.

How to Mitigate CVE-2026-64340

Immediate Actions Required

Apply the stable kernel update containing the kref-based lifetime fix for legousbtower from your distribution vendor.
On systems that do not need LEGO Mindstorms USB Tower support, unload and blacklist the legousbtower module.
Restrict physical USB port access on shared or high-value systems to reduce the attack surface for USB race conditions.

Patch Information

The fix is available across multiple stable branches. Refer to the upstream commits: 0b57e5ddbd89, 11d069f85851, 62fc8eb1b148, 6462de75d2e3, 766738ecf2b8, 9ba62966461a, ab2bfd7bec4f, and b4222c05066b. Update to a kernel version that includes the corresponding backport for your stable series.

Workarounds

Blacklist the legousbtower kernel module in /etc/modprobe.d/ where the device is not required.
Use USBGuard or equivalent policy tooling to deny binding of unauthorized USB device classes.
Limit local user access on systems that must retain the driver to reduce the number of processes that can open the device node.

bash

# Blacklist the vulnerable driver until the kernel is patched
echo 'blacklist legousbtower' | sudo tee /etc/modprobe.d/blacklist-legousbtower.conf
sudo rmmod legousbtower 2>/dev/null || true
sudo update-initramfs -u