CVE-2026-64344: Linux Kernel Use-After-Free Vulnerability

CVE-2026-64344 Overview

CVE-2026-64344 is a use-after-free vulnerability in the Linux kernel's USB idmouse driver. The flaw stems from improper use of mutex_unlock() to manage object lifetimes. When a device release() operation races with disconnect(), mutex_unlock() may access the mutex structure after the lock has been released, leading to use-after-free on freed driver data. The upstream fix replaces the direct-lifetime pattern with a kref reference count to safely coordinate teardown. Multiple stable kernel branches received backports.

Critical Impact
A local attacker with the ability to trigger USB disconnect while a handle is being released could cause kernel memory corruption, resulting in denial of service or potential local privilege escalation.

Affected Products

Linux kernel USB idmouse driver (drivers/usb/misc/idmouse.c)
Multiple upstream and stable Linux kernel branches (see referenced commits)
Distributions shipping affected kernel versions until stable backports are applied

Discovery Timeline

2026-07-25 - CVE-2026-64344 published to NVD
2026-07-25 - Last updated in NVD database

Technical Details for CVE-2026-64344

Vulnerability Analysis

The vulnerability [CWE-416, Use After Free] resides in the USB idmouse character device driver. The driver used a mutex to serialize between the character-device release() path and the USB disconnect() callback. It relied on holding the mutex during teardown to keep driver data alive.

The upstream locking documentation clarifies that mutex_unlock() is non-atomic and may still touch the struct mutex memory after the lock is released. Consequently, freeing the containing object while another thread is executing mutex_unlock() on an embedded mutex creates a use-after-free window inside the unlock path.

In idmouse, if release() frees the driver context while disconnect() is still returning from mutex_unlock() on that context's mutex (or vice versa), the kernel writes to memory that has already been released back to the slab allocator.

Root Cause

The root cause is a lifetime-management error: using an embedded mutex to gate destruction of the object that contains the mutex. Because mutex_unlock() may access the mutex after releasing the lock, the pattern is unsafe. The fix introduces a kref on the driver data so that the final put performs the free only after both the character-device and USB-core paths have released their references.

Attack Vector

Triggering the race requires local access and the ability to induce a USB disconnect while an open file descriptor for the idmouse device is being closed. This can be achieved on systems with physical USB access or in environments where an attacker controls virtual USB devices, for example through USB/IP or nested virtualization. Successful exploitation corrupts kernel heap state, which can lead to denial of service or, with additional primitives, escalation of privileges.

Verified proof-of-concept code is not published. See the referenced kernel commits for the patch diff:

Detection Methods for CVE-2026-64344

Indicators of Compromise

Kernel oops or panic messages referencing idmouse, mutex_unlock, or slab use-after-free in dmesg
KASAN reports flagging use-after-free in drivers/usb/misc/idmouse.c paths during release or disconnect
Unexpected USB device disconnect events immediately followed by kernel warnings on hosts exposing the idmouse device

Detection Strategies

Enable Kernel Address Sanitizer (KASAN) on test kernels to surface use-after-free windows in USB teardown paths
Inventory running kernels and compare against the fixed commits to identify unpatched hosts
Monitor kernel ring buffer for repeated USB idmouse teardown errors that may indicate exploitation attempts

Monitoring Recommendations

Forward journald and /var/log/kern.log to a central log platform and alert on kernel panics or BUG: messages tied to USB drivers
Track USB device connect and disconnect events using udev monitoring or auditd rules on /dev/idmouse*
Baseline expected USB device inventories on servers and alert on unexpected idmouse-class device attachments

How to Mitigate CVE-2026-64344

Immediate Actions Required

Apply the vendor-supplied stable kernel update that includes the referenced commits and reboot affected hosts
On systems that do not require the idmouse device, blacklist the module to remove the attack surface
Restrict physical and virtual USB access on multi-tenant and server systems until patches are deployed

Patch Information

The upstream fix replaces direct mutex-guarded destruction with a kref-based release. It has been merged and backported across multiple stable branches. Reference commits include 31e75fe, 54c2b73, 60fc5ef, 8d53b14, d0f61ac, e88cff5, f62622e, and ff002c15. Consult your distribution's advisories for the exact kernel package version containing the fix and update to that release or later.

Workarounds

Unload and blacklist the idmouse kernel module where the device is not in use
Disable USB passthrough for untrusted virtual machines and containers
Enforce physical port controls to prevent unauthorized USB device insertion on sensitive systems

bash

# Blacklist the idmouse module until a patched kernel is deployed
echo 'blacklist idmouse' | sudo tee /etc/modprobe.d/blacklist-idmouse.conf
sudo rmmod idmouse 2>/dev/null || true
sudo update-initramfs -u