CVE-2026-64343: Linux Kernel Use-After-Free Vulnerability

CVE-2026-64343 Overview

CVE-2026-64343 is a use-after-free vulnerability in the Linux kernel's ldusb USB driver. The flaw stems from improper lifetime management of driver data when a device release() operation races with disconnect(). The kernel's mutex_unlock() primitive may access the mutex structure after releasing the lock, so it cannot safely manage object lifetimes the way spinlocks or reference counts can. When both code paths execute concurrently, the driver data structure can be freed while mutex_unlock() still references it, producing a use-after-free condition in kernel memory.

Critical Impact
A local attacker with physical or virtual USB access can trigger the race by disconnecting the device while a file descriptor is being released, potentially leading to kernel memory corruption.

Affected Products

Linux kernel ldusb driver (drivers/usb/misc/ldusb.c)
Multiple stable Linux kernel branches receiving backported fixes
Systems exposing USB device attachment to untrusted users or peripherals

Discovery Timeline

2026-07-25 - CVE-2026-64343 published to NVD
2026-07-25 - Last updated in NVD database

Technical Details for CVE-2026-64343

Vulnerability Analysis

The ldusb driver manages per-device state in a driver data structure protected by a mutex. When a user-space process closes its file descriptor, the kernel invokes the driver's release() handler. If a USB disconnect() event fires concurrently, both paths compete for the same driver data. The release() handler calls mutex_unlock() on the driver's mutex, but mutex_unlock() is documented as non-atomic and may touch the mutex memory after the lock is released. If disconnect() frees the containing driver data between the mutex release and the final memory accesses inside mutex_unlock(), the kernel dereferences freed memory. This is a classic use-after-free [CWE-416] triggered by a concurrency window.

Root Cause

The root cause is using mutex_unlock() as a lifetime barrier for the containing object. As documented in kernel commits a51749ab34d9 and 2b9d9e0a9ba0, sleeping locks including mutexes can still reference the lock object after unlock returns. The ldusb driver relied on the mutex to serialize release and disconnect, but did not maintain a reference count to keep the driver data alive across the unlock.

Attack Vector

An attacker with the ability to attach and detach a USB device, or to script rapid disconnect events on an emulated USB endpoint, can race the file close path against the disconnect path. Successful exploitation requires precise timing to hit the narrow window between mutex_unlock() releasing the lock and completing its internal writes. Exploitation may lead to kernel information disclosure, denial of service through kernel panic, or in some scenarios memory corruption enabling privilege escalation.

No verified proof-of-concept code is published for this issue. See the upstream fixes on kernel.org for the corrective patch that introduces a kref to manage driver data lifetime.

Detection Methods for CVE-2026-64343

Indicators of Compromise

Unexpected kernel oops or panic messages referencing ldusb, mutex_unlock, or __mutex_unlock_slowpath in dmesg or /var/log/kern.log
KASAN reports flagging use-after-free in drivers/usb/misc/ldusb.c on kernels built with sanitizers enabled
Repeated USB attach/detach events for LD Didactic devices correlated with kernel warnings

Detection Strategies

Enable Kernel Address Sanitizer (KASAN) and lockdep on test kernels to surface the race condition during fuzzing or QA
Monitor kernel ring buffer messages for stack traces implicating ldusb_release and mutex_unlock
Deploy USB device policy tools such as usbguard to log and alert on unauthorized USB attach events

Monitoring Recommendations

Forward kernel logs to a central SIEM and alert on Oops, BUG:, or KASAN strings tied to USB subsystems
Track kernel version inventory across the fleet to confirm which hosts have received the backported fix
Correlate USB hotplug telemetry with process crashes on multi-user or lab systems

How to Mitigate CVE-2026-64343

Immediate Actions Required

Update to a Linux kernel release that includes the upstream fix introducing a kref for ldusb driver data lifetime
Apply distribution vendor kernel updates as soon as they publish backported patches referencing this CVE
Restrict physical and virtual USB access on multi-user systems, lab environments, and kiosks

Patch Information

The fix replaces mutex-based lifetime management with a reference count (kref) so driver data persists until every user, including the trailing mutex_unlock(), releases its reference. The corrective commits are available on kernel.org:

Workarounds

Blacklist the ldusb kernel module on systems that do not require LD Didactic USB device support
Enforce USB device allow-listing with usbguard to block untrusted vendor and product IDs
Limit interactive and remote user access on systems where the module cannot be removed

bash

# Blacklist the ldusb module until patched kernels are deployed
echo "blacklist ldusb" | sudo tee /etc/modprobe.d/blacklist-ldusb.conf
sudo rmmod ldusb 2>/dev/null || true
sudo update-initramfs -u