Double free in Linux kernel - CVE-2026-64242

Vulnerability identifier: #VU139748

CSH Severity: Low

CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-64242

CWE-ID: CWE-415

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to double free in net2280_probe() error handling in the net2280 usb gadget driver when probing a device. A local user can trigger the probe error path to cause a denial of service.

Linux kernel
Ubuntu
linux-aws (Ubuntu package)
linux-gcp-7.0 (Ubuntu package)
linux-nvidia (Ubuntu package)
linux-nvidia-bos (Ubuntu package)

Install security update from vendor's repository.

Linux kernel - update to 7.0 rc3
linux-aws (Ubuntu package) - addressed in versions 7.0.0-1009.9, 7.0.0-1015.15
linux-gcp-7.0 (Ubuntu package) - update to 7.0.0-1011.11~24.04.1
linux-nvidia (Ubuntu package) - addressed in versions 7.0.0-1016.16, 7.0.0-1016.16~24.04.1
linux-nvidia-bos (Ubuntu package) - update to 7.0.0-2016.16

• https://git.kernel.org/stable/c/085652fda7f38040d1a2c42d72614f418feb843f
• https://git.kernel.org/stable/c/48f89ead20e48d447ad29fa937b43b9fa981cf28
• https://git.kernel.org/stable/c/550fa4d071a8c8e53072900869d37ae6abf4999d
• https://git.kernel.org/stable/c/71b3391dc81655ff058492f8e9d013b2c6e5747b
• https://git.kernel.org/stable/c/c5b9fdb1e8ddf50bc6272927edb118679f170350
• https://git.kernel.org/stable/c/c8547c74988e0b5f4cbb1b895e2a57aae084f070
• https://git.kernel.org/stable/c/db2b72e83a0208ae2b3b270bf91662b1c6849a9b
• https://git.kernel.org/stable/c/e6f8be12f0307145b9a6010f044925952b37de8b

• Double free in Linux kernel gadget udc driver
• Ubuntu update for linux-aws
• Ubuntu update for linux-nvidia-bos
• Ubuntu update for linux-nvidia
• Ubuntu update for linux-gcp-7.0