CVE-2026-64455: Linux Kernel Use-After-Free Vulnerability

CVE-2026-64455 Overview

CVE-2026-64455 is a use-after-free vulnerability in the Linux kernel's USB chaoskey driver. The flaw resides in the chaoskey_release() function within drivers/usb/misc/chaoskey.c. When a user closes the device file after the associated USB device has been unplugged, a debugging log statement attempts to access the usb_interface structure after it has already been deallocated by chaoskey_free(). Kernel Address Sanitizer (KASAN) detects the invalid read as a slab-use-after-free condition. The upstream fix removes the offending debug statement entirely, eliminating the dangling reference [CWE-416].

Critical Impact
Local users with access to a chaoskey USB hardware random number generator device file can trigger kernel memory corruption by closing the file descriptor after device disconnect.

Affected Products

Linux kernel versions containing the chaoskey USB driver in drivers/usb/misc/chaoskey.c
Multiple stable kernel branches receiving backported fixes across eight commits
Systems using Altus Metrum ChaosKey USB hardware random number generator hardware

Discovery Timeline

2026-07-25 - CVE-2026-64455 published to NVD
2026-07-25 - Last updated in NVD database

Technical Details for CVE-2026-64455

Vulnerability Analysis

The chaoskey driver supports the Altus Metrum ChaosKey USB hardware random number generator. The driver maintains a reference count on the usb_interface structure and releases its final reference inside chaoskey_free(). After that function returns, the interface pointer is no longer safe to dereference.

The chaoskey_release() routine invoked chaoskey_free() and then executed a dev_dbg() debugging statement that dereferenced the freed usb_interface through dev_driver_string(). When KASAN is enabled, this triggers a slab-use-after-free report at drivers/base/core.c:2406. Without KASAN, the read silently accesses reclaimed slab memory, which can contain attacker-influenced data reused by other kernel allocations.

Root Cause

The root cause is a lifetime management error. The driver dropped its last reference to the usb_interface via chaoskey_free() but then continued to use the interface pointer in a dynamic debug log statement. Kernel maintainers noted that dereferencing an object after releasing its final reference is unsafe unless another entity, such as the device core during disconnect, is known to hold an active reference. In the release path, no such guarantee exists.

Attack Vector

Exploitation requires local access to the chaoskey character device and physical or administrative control to unplug the USB device. An attacker performs three steps: open the chaoskey device file, disconnect the USB hardware, then close the file descriptor. The close syscall path executes __fput → chaoskey_release, triggering the use-after-free. The bug is not remotely exploitable and depends on the presence of ChaosKey USB hardware or a virtualized USB device passthrough. See the upstream fix commit for the code change.

Detection Methods for CVE-2026-64455

Indicators of Compromise

KASAN reports containing slab-use-after-free in dev_driver_string with a call trace including chaoskey_release and __fput
Unexpected kernel oops or panic entries in dmesg following USB device disconnect events on hosts using chaoskey
Kernel log entries referencing drivers/usb/misc/chaoskey.c:323 on unpatched builds

Detection Strategies

Enable KASAN on test and staging kernels to surface the exact use-after-free signature during QA cycles
Audit loaded kernel modules with lsmod | grep chaoskey to identify systems where the vulnerable driver is active
Compare running kernel versions against the fixed commits listed on git.kernel.org to identify unpatched hosts

Monitoring Recommendations

Forward dmesg and /var/log/kern.log to a centralized log platform and alert on KASAN or oops signatures referencing chaoskey
Track USB device attach and detach events via udev monitoring for hosts with the driver loaded
Monitor kernel package inventory across the fleet to confirm patched versions are deployed on all Linux endpoints

How to Mitigate CVE-2026-64455

Immediate Actions Required

Update to a Linux kernel version that includes one of the fix commits published on git.kernel.org
If patching is not immediately possible, blacklist the chaoskey module on systems that do not require the hardware random number generator
Restrict physical and administrative access to hosts equipped with ChaosKey USB hardware

Patch Information

The fix removes the debug statement in chaoskey_release() that accessed the freed usb_interface. Distributors have backported the change across multiple stable branches. Reference commits include 2a52d55c, 3ad5fbcc, 5ec61fbe, 6c82f88b, 8f50613b, abf76d32, f3e40947, and fe7a0f4b.

Workarounds

Unload the driver with modprobe -r chaoskey on systems that do not depend on the ChaosKey device
Add blacklist chaoskey to /etc/modprobe.d/blacklist-chaoskey.conf to prevent auto-loading
Disable USB passthrough for chaoskey devices in virtualized environments until the host kernel is patched

bash

# Configuration example
echo "blacklist chaoskey" | sudo tee /etc/modprobe.d/blacklist-chaoskey.conf
sudo modprobe -r chaoskey
sudo update-initramfs -u