Use-after-free in Linux kernel - CVE-2026-64341
Published: July 27, 2026
Vulnerability identifier: #VU139632
CSH Severity: Low
CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-64341
CWE-ID: CWE-416
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to cause a denial of service or execute arbitrary code.
The vulnerability exists due to use-after-free in the iowarrior USB driver when release() races with disconnect(). A local user can trigger device release and disconnection in a racing condition to cause a denial of service or execute arbitrary code.
Exploitation requires access to the affected USB device interface.
Affected software
Linux kernel
Debian Linux
linux (Debian package)
Debian Linux
linux (Debian package)
How to mitigate CVE-2026-64341
Install security update from vendor's repository.
Linux kernel - update to 7.0 rc3
linux (Debian package) - update to 6.12.100-1
linux (Debian package) - update to 6.12.100-1