CVE-2026-64453

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

usb: misc: usbio: fix disconnect UAF in client teardown

usbio_disconnect() walks usbio->cli_list in reverse and uninitializes each

auxiliary device. auxiliary_device_uninit() drops the device reference, and

for an unbound child that can run usbio_auxdev_release() and free the

containing struct usbio_client.

list_for_each_entry_reverse() advances after the loop body by reading

client->link.prev. If the current client is freed by

auxiliary_device_uninit(), the iterator dereferences freed memory.

Use list_for_each_entry_safe_reverse() so the previous client is

cached before the body can drop the final reference. This preserves

reverse teardown order while keeping the next iterator cursor independent

of the current client's lifetime.

Validation reproduced this kernel report:

BUG: KASAN: slab-use-after-free in usbio_disconnect+0x12e/0x150

Call Trace:

<TASK>

dump_stack_lvl+0x66/0xa0

print_report+0xce/0x630

? usbio_

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References