CVE-2026-64346

CVE CVE-2026-64346EUVD EUVD-2026-48890Published 2026-07-25T08:50:07.000ZLast changed 2026-07-27T04:37:30.000Z

What the advisory describes

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: udc: Fix use-after-free in gadget_match_driver The udc structure acts as the management structure for the gadget, but their lifecycles are decoupled. A race condition exists where usb_del_gadget() frees the udc memory (e.g., via mode-switch work) while gadget_match_driver() concurrently accesses the freed udc memory (e.g., via configfs), causing a Use-After-Free (UAF) that triggers a NULL pointer dereference when the freed memory is zeroed: [39430.908615][ T1171] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 [39430.911397][ T1171] pc : __pi_strcmp+0x20/0x140 [39430.911441][ T1171] lr : gadget_match_driver+0x34/0x60 ... [39430.911890][ T1171] usb_gadget_register_driver_owner+0x50/0xf8 [39430.911910][ T1171] gadget_dev_desc_UDC_store+0xf4/0x140 [39430.931308][ T1171] configfs_write_iter+0xec/0x134 [39430.957058][ T1171] Workqueue: events_freezable __dwc3_set_mode [39430.957287][ T1171] dwc3_gadget_exit+0x34/0x8c [39430.957304][ T1171] __dwc3_set_mode+0xc0/0x664 Fix this by ensuring the udc structure remains allocated until the gadget is released. To achieve this, introduce a new usb_gadget_release() routine to the core. When the gadget is added, usb_add_gadget() stores the gadget's release routine in the udc structure and takes a reference to the udc. When the gadget is released, usb_gadget_release() drops the reference to the udc and then calls the gadget's release routine.

Source: EUVD (ENISA), in the words of the advisory.

Products the advisory names

These come from the advisory itself, not from any check we performed.

Linux — Linux patch: 0; fc274c1e997314bf47f6a62c79b5d7e554ed59c4 <50eeb8e8a4f389efc91b93cff14a683e714ec194; fc274c1e997314bf47f6a62c79b5d7e554ed59c4 <d026f71df141c9b064ff32a78af5391a31ef75c2; fc274c1e997314bf47f6a62c79b5d7e554ed59c4 <54fa390aae393eb130f307a85562e3001cc39a52; fc274c1e997314bf47f6a62c79b5d7e554ed59c4 <67e511d2989eb1c8c588b599ce2fcc6bb8e6f7ea; patch: 6.12.96; patch: 6.6.145; patch: 6.18.39; fc274c1e997314bf47f6a62c79b5d7e554ed59c4 <7a5214dae906d9f58e07bc4995e8181ee74439f4; patch: 7.1.4; 5.19; patch: 6.1.178; patch: 7.2-rc3; fc274c1e997314bf47f6a62c79b5d7e554ed59c4 <b52476a83d9e12df00765359d728a875b128bef1

The versions shown are the advisory's own. Patchlage compares no version numbers and derives no judgement from them — which version is installed is something a person has to look up.

Carried in the product catalogue

An estate covering these products can be recorded in Patchlage. An advisory about them appears in the next morning's situation report.

Linux — Linux

Does this concern one of your customers?

This page cannot answer that — it does not know your estate. Whoever has recorded their environments gets the answer the morning after publication, together with a paragraph they can forward to the customer unedited.

Try it for 28 days

Patchlage reports hits and suspected hits. About everything else this system says nothing — neither this page nor the situation report ever claims that an estate is safe.