CVE-2026-64242 Linux CVE debrief

Who should care

Linux kernel developers, Linux system administrators, and users of Linux-based systems, especially those using net2280 devices, should review and apply patches or mitigations to prevent potential double-free vulnerabilities. Security teams and vulnerability management teams should prioritize patching and monitor for suspicious usb gadget activity. Additionally, operators and platform administrators should assess their exposure and implement compensating controls if necessary. Security teams should also track exceptions and retest remediated assets to ensure the vulnerability is properly addressed. Linux-based system users should stay informed about updates and patches for their specific Linux kernel versions. Those responsible for Linux kernel development and maintenance should prioritize resolving this issue and testing for similar vulnerabilities in the future. Linux distribution maintainers should also verify and update their packages accordingly. Finally, security researchers should continue to investigate and disclose similar issues to improve the security of the Linux kernel and related components. The vulnerability's impact on various Linux kernel versions and the difficulty in detecting it make it essential for a wide range of stakeholders to take action. Linux users and administrators should verify their kernel versions and stay up-to-date with the latest security patches to mitigate this vulnerability effectively. Linux distributions should also ensure that their packages are updated and patched accordingly. By taking these steps, Linux kernel developers, administrators, and users can work together to prevent potential attacks and improve the overall security of Linux-based systems. Linux kernel developers should also review their code and testing procedures to prevent similar issues in the future. Linux system administrators should prioritize patching and implement additional security measures, such as monitoring and compensating controls, to protect their systems from potential attacks. Users of Linux-based systems should also be aware of the vulnerability and take steps to protect themselves, such as keeping their systems up-to-date and informed. By

Technical summary

The Linux kernel's usb gadget driver for net2280 devices has a double-free vulnerability. When the probe function encounters an error, it calls net2280_remove(), which drops the gadget reference with usb_put_gadget(). However, the explicit kfree(dev) call afterwards can free the same object again, leading to a double-free issue. This can be fixed by removing the explicit kfree() call and letting the gadget device release callback handle the final free.

Defensive priority

High

Recommended defensive actions

• Apply patches from Linux kernel stable branch
• Inventory Linux systems for net2280 gadget usage
• Monitor for suspicious usb gadget activity
• Restrict access to vulnerable Linux kernel versions
• Update Linux kernel to version 5.10.260 or later, 5.15.211 or later, 6.1.177 or later, 6.6.144 or later, 6.7 or later, 6.12.94 or later, 6.18.36 or later, 7.0.13 or later

Evidence notes

The vulnerability was found by a static analysis tool. The affected Linux kernel versions are 5.10 to 5.10.259, 5.11 to 5.15.210, 5.16 to 6.1.176, 6.2 to 6.6.143, 6.7 to 6.12.93, 6.13 to 6.18.35, 6.19 to 7.0.12, and 7.1 rc1 to rc5. To verify, defenders should review Linux kernel version usage and check for updates or patches from the Linux kernel stable branch.

Official resources