Use-after-free in Linux kernel - CVE-2026-64233
Published: July 27, 2026
Vulnerability identifier: #VU139769
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2026-64233
CWE-ID: CWE-416
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vendor: Linux Foundation
Affected software:
Linux kernel
Linux kernel
Detailed vulnerability description
The vulnerability allows a local privileged user to cause a use-after-free.
The vulnerability exists due to a use-after-free in uvc_function_bind() and descriptor handling for extension unit list walks when binding the UVC gadget function while concurrently removing an extension unit configfs directory. A local privileged user can bind the function and race configfs extension removal to cause a use-after-free.
Exploitation requires the ability to mount configfs and write gadget UDC files.
How to mitigate CVE-2026-64233
Install security update from vendor's repository.
Sources
- https://git.kernel.org/stable/c/2c9e0905ef7e69f7b814cd709613f6b3b5b98805
- https://git.kernel.org/stable/c/5f1b9cff88982e2a2053d8b1fd983f7ccb9f03cc
- https://git.kernel.org/stable/c/68aa70648b625fa684bc0b71bbfd905f4943ca20
- https://git.kernel.org/stable/c/caec0145e5974e85fe5192fc6a6f5aa1a98f82a6
- https://git.kernel.org/stable/c/e15c414092b3c24610cc771e481a723b0f645eca