CVE-2026-31672 Details
Description
In the Linux kernel, the following vulnerability has been resolved: wifi: rt2x00usb: fix devres lifetime USB drivers bind to USB interfaces and any device managed resources should have their lifetime tied to the interface rather than parent USB device. This avoids issues like memory leaks when drivers are unbound without their devices being physically disconnected (e.g. on probe deferral or configuration changes). Fix the USB anchor lifetime so that it is released on driver unbind.
A vulnerability has been identified in the Linux kernel's handling of USB driver resource lifetimes, specifically within the rt2x00usb wireless driver. This issue can lead to memory leaks when drivers are unbound without their corresponding devices being physically disconnected, such as during probe deferrals or configuration changes. The vulnerability arises because the lifetime of device-managed resources is tied to the parent USB device instead of the USB interface. The problem has been addressed by modifying the resource management to align with the correct interface, ensuring that resources are properly released when the driver is unbound.
Users can upgrade to the latest version of the Linux kernel where this vulnerability has been fixed. Instructions for downloading the patched version are available on the Linux kernel's official website.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/15b233e33b35b927bd8d0044c15325564ea1ba24 | kernel.org | Patch |
| https://git.kernel.org/stable/c/1de5c76bf40e9cdeebf54662f63011fb10fa452f | kernel.org | Patch |
| https://git.kernel.org/stable/c/25369b22223d1c56e42a0cd4ac9137349d5a898e | kernel.org | Patch |
| https://git.kernel.org/stable/c/64a457f6afbf15f984d95201a9a1e71eed3f9dd1 | kernel.org | Patch |
| https://git.kernel.org/stable/c/65518a6965d527c53013947031f26754f6a4f6af | kernel.org | Patch |
| https://git.kernel.org/stable/c/b245db719bc7e57abf48bd5701662b270c3880f7 | kernel.org | Patch |
| https://git.kernel.org/stable/c/c99f198841b41735796e2ddfcd573783fb552eb9 | kernel.org | Patch |
| https://git.kernel.org/stable/c/e360d15fcb1e819eef49e3d4434d8050542eed16 | kernel.org | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-401 | Missing Release of Memory after Effective Lifetime | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 4.7.1, < 5.10.253 >= 5.11, < 5.15.203 >= 5.16, < 6.1.169 >= 6.2, < 6.6.135 >= 6.7, < 6.12.82 >= 6.13, < 6.18.23 >= 6.19, < 6.19.13 4.7 - 7.0 rc1 7.0 rc2 7.0 rc3 7.0 rc4 7.0 rc5 7.0 rc6 7.0 rc7 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | kernel.org |
| Apr 27, 2026 | Initial Analysis | [email protected] |
| Apr 24, 2026 | New CVE Received | kernel.org |