SB20260727337 - Double free in Linux kernel gadget udc driver
Published: July 27, 2026
Security Bulletin ID
SB20260727337
CSH Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Local access
Highest impact
Denial of service
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 vulnerability.
1) Double free (CVE-ID: CVE-2026-64242)
CWE-ID: CWE-415 - Double Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to double free in net2280_probe() error handling in the net2280 usb gadget driver when probing a device. A local user can trigger the probe error path to cause a denial of service.
Remediation
Install update from vendor's website.
References
- https://git.kernel.org/stable/c/085652fda7f38040d1a2c42d72614f418feb843f
- https://git.kernel.org/stable/c/48f89ead20e48d447ad29fa937b43b9fa981cf28
- https://git.kernel.org/stable/c/550fa4d071a8c8e53072900869d37ae6abf4999d
- https://git.kernel.org/stable/c/71b3391dc81655ff058492f8e9d013b2c6e5747b
- https://git.kernel.org/stable/c/c5b9fdb1e8ddf50bc6272927edb118679f170350
- https://git.kernel.org/stable/c/c8547c74988e0b5f4cbb1b895e2a57aae084f070
- https://git.kernel.org/stable/c/db2b72e83a0208ae2b3b270bf91662b1c6849a9b
- https://git.kernel.org/stable/c/e6f8be12f0307145b9a6010f044925952b37de8b