CVE-2026-64341: Linux Kernel Use-After-Free Vulnerability

CVE-2026-64341 Overview

CVE-2026-64341 is a use-after-free vulnerability in the Linux kernel USB iowarrior driver. The flaw occurs when the driver's release() function races with disconnect(), causing mutex_unlock() to access driver data after it has been freed. Because mutex_unlock() may access the mutex structure after releasing the lock, it cannot safely manage object lifetime. The upstream fix introduces a kref reference count to properly manage driver data lifetime and prevent the use-after-free condition.

Critical Impact
A local user with access to an IO-Warrior USB device can trigger a race between file release() and USB disconnect(), potentially leading to kernel memory corruption and privilege escalation.

Affected Products

Linux kernel USB iowarrior driver (drivers/usb/misc/iowarrior.c)
Systems with IO-Warrior USB devices attached
Multiple Linux kernel stable branches (see upstream commits for exact versions)

Discovery Timeline

2026-07-25 - CVE-2026-64341 published to NVD
2026-07-25 - Last updated in NVD database

Technical Details for CVE-2026-64341

Vulnerability Analysis

The iowarrior USB driver manages per-device state that is shared between the character device file operations and the USB core disconnect handler. When a userspace process closes its file descriptor, the driver's release() path runs concurrently with USB disconnect() if the device is unplugged at the same moment.

Both paths take a mutex to coordinate teardown. The problem is that mutex_unlock() is documented as non-atomic: it may still touch the mutex structure after releasing the lock. If the other path frees the containing driver-data object between the unlock and the internal post-unlock access, the kernel reads and writes freed memory.

This is a classic use-after-free [CWE-416] driven by a race condition [CWE-362] on object lifetime. Exploiting the freed slab object can lead to kernel memory corruption.

Root Cause

The driver used a mutex both as a critical-section primitive and as an implicit lifetime guarantee for the driver data. Because mutex_unlock() can access the mutex after it releases the lock, the object protected by the mutex must outlive the unlock call. The original code did not guarantee this ordering when release() and disconnect() interleaved.

Attack Vector

Exploitation requires local access to a system with an IO-Warrior USB device, or the ability to attach and detach such a device. An attacker triggers the race by opening the character device and closing the file descriptor while the device is being disconnected. Winning the race frees the driver data before mutex_unlock() completes, producing kernel-space use-after-free that can be shaped into memory corruption.

The fix replaces implicit mutex-based lifetime management with an explicit kref reference count, releasing driver data only when the final reference is dropped. See the upstream commits 3c0a7b29ebb3, 71590982700f, and c602254ba4c1 for the applied patches.

Detection Methods for CVE-2026-64341

Indicators of Compromise

Kernel oops or panic messages referencing iowarrior, mutex_unlock, or iowarrior_release
KASAN reports flagging use-after-free in drivers/usb/misc/iowarrior.c
Unexpected process crashes or kernel warnings coinciding with USB device disconnect events

Detection Strategies

Enable KASAN (Kernel Address Sanitizer) on test kernels to surface use-after-free access on the freed iowarrior driver data slab object
Monitor dmesg and /var/log/kern.log for USB disconnect events immediately followed by kernel warnings or oops entries
Audit installed kernel packages against distribution advisories that reference the upstream fix commits

Monitoring Recommendations

Collect kernel logs centrally and alert on BUG:, WARNING:, or KASAN: strings correlated with usb or iowarrior subsystems
Track USB device attach and detach events on servers and workstations where IO-Warrior devices are not expected
Baseline kernel versions across the fleet and flag hosts still running unpatched stable branches

How to Mitigate CVE-2026-64341

Immediate Actions Required

Apply the vendor-supplied kernel update that includes the iowarriorkref lifetime fix as soon as your distribution publishes it
Reboot systems after patching to ensure the vulnerable kernel image is no longer running
Where patching is delayed, restrict physical access to USB ports on affected hosts to reduce local attack surface

Patch Information

The fix is available in the mainline and stable trees via commits 3c0a7b29ebb3, 71590982700f, and c602254ba4c1. The patch introduces a kref to release the driver data only when all references are dropped, ensuring the object outlives any mutex_unlock() internal access. Consult your Linux distribution's security advisories for the specific package versions that include this fix.

Workarounds

Blacklist the iowarrior kernel module on hosts that do not require IO-Warrior device support by adding blacklist iowarrior to /etc/modprobe.d/
Unload the module with modprobe -r iowarrior if no IO-Warrior device is currently in use
Enforce USB device allowlisting via USBGuard or equivalent controls to prevent unauthorized device attachment

bash

# Disable the vulnerable driver where it is not required
echo "blacklist iowarrior" | sudo tee /etc/modprobe.d/blacklist-iowarrior.conf
sudo modprobe -r iowarrior

# Verify the module is no longer loaded
lsmod | grep iowarrior