CVE-2026-64345: Linux Kernel Privilege Escalation Flaw

CVE-2026-64345 Overview

CVE-2026-64345 is a reference count leak vulnerability in the Linux kernel's USB gadget printer function driver (f_printer). The flaw resides in printer_open(), which increments dev->kref unconditionally even when the open operation fails with -EBUSY because the character device is already open. Since the Virtual File System (VFS) does not invoke ->release() for a failed open, every rejected second open permanently leaks one reference. Over time, repeated failed opens exhaust the reference counter and prevent the underlying device structure from ever being freed.

Critical Impact
Repeated failed opens of the printer character device leak kernel references, leading to resource exhaustion and preventing proper cleanup of the USB gadget printer device.

Affected Products

Linux kernel (upstream) with the USB gadget f_printer function driver enabled
Stable kernel branches receiving backports referenced in the fix commits
Distributions shipping kernels prior to the fix commits listed in the Linux kernel stable tree

Discovery Timeline

2026-07-25 - CVE-2026-64345 published to NVD
2026-07-25 - Last updated in NVD database

Technical Details for CVE-2026-64345

Vulnerability Analysis

The defect lives in the USB gadget printer function driver, specifically the printer_open() file operations handler. When a userspace process opens the printer character device, the driver calls kref_get() on dev->kref to track the open reference. If another process already holds the device open, the driver returns -EBUSY to reject the second opener.

The problem is ordering. The kref_get() executes before the busy check completes its rejection path, so the reference count increases even when the open fails. The VFS layer only calls the driver's ->release() handler for successful opens, so the extra reference is never balanced by a matching kref_put(). Each rejected open permanently leaks one kernel reference on the device structure.

Root Cause

The root cause is an improper ordering of resource acquisition relative to the success determination in printer_open(). The reference increment should occur only after the driver has confirmed the open will succeed. This is a classic reference counting bug pattern where cleanup on the error path is absent because the framework does not invoke a release callback for failed opens.

Attack Vector

A local user with permission to open the printer gadget character device node can trigger the leak by repeatedly attempting to open the device while another handle is already open. Each failed open() syscall increments the kernel reference count without a matching decrement. Sustained exploitation prevents the device structure from being freed on disconnect and can lead to resource exhaustion in long-running systems that expose the USB gadget printer function.

The upstream fix relocates kref_get() into the successful-open branch, ensuring the reference is only taken when the open will proceed to a matching release() call. See the patch commit for the exact source change.

Detection Methods for CVE-2026-64345

Indicators of Compromise

Growing kref values on the USB gadget printer device that do not decrease after device close operations
Kernel warnings or slab accounting anomalies referencing the f_printer driver after device teardown
Failed open() syscalls returning -EBUSY against /dev/g_printer* device nodes in high volume

Detection Strategies

Audit running kernel versions against the fixed commit hashes published in the Linux kernel stable tree references
Use ftrace or kprobes on printer_open to correlate return values with kref increments
Monitor for repeated -EBUSY return codes from opens against printer gadget device nodes via strace or eBPF instrumentation

Monitoring Recommendations

Track kernel slab allocations for the printer device structure over time to detect unbounded growth
Alert on abnormal frequencies of failed open() calls to USB gadget character devices from unprivileged processes
Collect kernel logs from systems exposing USB gadget functions and forward them to a central analytics platform for retention and correlation

How to Mitigate CVE-2026-64345

Immediate Actions Required

Update affected Linux kernels to a version that includes the f_printer fix commits referenced in the NVD entry
If patching is not immediately feasible, restrict access to USB gadget printer character device nodes to trusted users only
Disable the f_printer USB gadget function on systems that do not require printer gadget functionality

Patch Information

The fix moves kref_get() inside the branch that handles a successful open, ensuring the reference count is only incremented when a matching release() call will eventually run. Fix commits are available in the upstream stable tree, including 30adce93, 75c0ad13, 7f1f24c3, 8a5eba99, 94ec20d9, and bf20c94f. Distribution vendors are expected to backport these commits into their supported kernel branches.

Workarounds

Unload the usb_f_printer kernel module on systems that do not need USB gadget printer functionality
Tighten permissions on /dev/g_printer* device nodes so only trusted service accounts can open them
Avoid configuring the printer function in USB gadget configurations on production systems until patched kernels are deployed

bash

# Verify whether the f_printer module is loaded and unload if unused
lsmod | grep usb_f_printer
sudo modprobe -r usb_f_printer

# Restrict access to the printer gadget device node
sudo chmod 600 /dev/g_printer0
sudo chown root:root /dev/g_printer0