Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-07-25T00:00:00 kernel: USB: legousbtower: fix use-after-free on disconnect race 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CWE-364

In the Linux kernel, the following vulnerability has been resolved: USB: legousbtower: fix use-after-free on disconnect race mutex_unlock() may access the mutex structure after releasing the lock and therefore cannot be used to manage lifetime of objects directly (unlike spinlocks and refcounts). [1][2] Use a kref to release the driver data to avoid use-after-free in mutex_unlock() when release() races with disconnect(). [1] a51749ab34d9 ("locking/mutex: Document that mutex_unlock() is non-atomic") [2] 2b9d9e0a9ba0 ("locking/mutex: Clarify that mutex_unlock(), and most other sleeping locks, can still use the lock object after it's unlocked")

A flaw was found in the Linux kernel's `legousbtower` USB driver. This vulnerability is a use-after-free, which means the system attempts to use memory after it has been released. It occurs due to a timing issue (race condition) when a USB device is disconnected, potentially leading to system instability or crashes.

Red Hat Enterprise Linux 10 Affected kernel Red Hat Enterprise Linux 6 Out of support scope kernel Red Hat Enterprise Linux 7 Affected kernel Red Hat Enterprise Linux 7 Affected kernel-rt Red Hat Enterprise Linux 8 Affected kernel Red Hat Enterprise Linux 8 Affected kernel-rt Red Hat Enterprise Linux 9 Affected kernel Red Hat Enterprise Linux 9 Affected kernel-rt https://www.cve.org/CVERecord?id=CVE-2026-64340 https://nvd.nist.gov/vuln/detail/CVE-2026-64340 https://lore.kernel.org/linux-cve-announce/2026072515-CVE-2026-64340-1720@gregkh/T