CVE-2026-64242 Details
Description
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: net2280: Fix double free in probe error path usb_initialize_gadget() installs gadget_release() as the release callback for the embedded gadget device. The struct net2280 instance is therefore released through gadget_release() when the gadget device's last reference is dropped. The probe error path calls net2280_remove(), which tears down the partially initialized device and drops the gadget reference with usb_put_gadget(). Calling kfree(dev) afterwards can free the same object again. Drop the explicit kfree() and let the gadget device release callback handle the final free. This issue was found by a static analysis tool I am developing.
A double free vulnerability has been identified in the Linux kernel's USB gadget net2280 driver. This issue arises during the probe error handling, where the driver improperly manages memory references. Specifically, the usb_initialize_gadget function sets up a release callback for the net2280 instance. If an error occurs during the probe, the net2280_remove function is called, which cleans up the device and decreases the reference count. However, the subsequent call to free the device can inadvertently free the same memory again, leading to a double free condition. This vulnerability affects the Linux kernel stable group.
Users can upgrade to the latest version of the Linux kernel where this vulnerability has been patched. The official Linux kernel Git repository can be checked out for the latest stable releases.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/085652fda7f38040d1a2c42d72614f418feb843f | kernel.org | Patch |
| https://git.kernel.org/stable/c/48f89ead20e48d447ad29fa937b43b9fa981cf28 | kernel.org | Patch |
| https://git.kernel.org/stable/c/550fa4d071a8c8e53072900869d37ae6abf4999d | kernel.org | Patch |
| https://git.kernel.org/stable/c/71b3391dc81655ff058492f8e9d013b2c6e5747b | kernel.org | Patch |
| https://git.kernel.org/stable/c/c5b9fdb1e8ddf50bc6272927edb118679f170350 | kernel.org | Patch |
| https://git.kernel.org/stable/c/c8547c74988e0b5f4cbb1b895e2a57aae084f070 | kernel.org | Patch |
| https://git.kernel.org/stable/c/db2b72e83a0208ae2b3b270bf91662b1c6849a9b | kernel.org | Patch |
| https://git.kernel.org/stable/c/e6f8be12f0307145b9a6010f044925952b37de8b | kernel.org | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-415 | Double Free | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 5.10, < 5.10.259 >= 5.11, < 5.15.210 >= 5.16, < 6.1.176 >= 6.2, < 6.6.143 >= 6.7, < 6.12.93 >= 6.13, < 6.18.35 >= 6.19, < 7.0.12 7.1 rc1 7.1 rc2 7.1 rc3 7.1 rc4 7.1 rc5 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 13, 2026 | Initial Analysis | [email protected] |
| Jul 24, 2026 | New CVE Received | kernel.org |