CVE Explorer

CVE-2026-64346

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: udc: Fix use-after-free in gadget_match_driver The udc structure acts as the management structure for the gadget, but their lifecycles are decoupled. A race condition exists where usb_del_gadget() frees the udc memory (e.g., via mode-switch work) while gadget_match_driver() concurrently accesses the freed udc memory (e.g., via configfs), causing a Use-After-Free (UAF) that triggers a NULL pointer dereference when

Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:054dc1f07083293af83bd91ec2786827fe741ac11b24f20138e3b858e994b0fb

Known exploited

Not asserted

Disputed

Stale source

Conflicts

Preserved source conflicts

No provider value was silently selected as the winner.

affected · 2 assertions

{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/usb/gadget/udc/core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.19"},{"lessThan":"5.19","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.178","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.145","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.96","versionType":"semver"},{"le…

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:706e3492ac5b5e425d6b2b0947bd1d9065ddd2be55a5f95c9a16ad9058f415d3 · sha256:14c42e31d6064d2e… · /containers/cna/affected/1

{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/usb/gadget/udc/core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"50eeb8e8a4f389efc91b93cff14a683e714ec194","status":"affected","version":"fc274c1e997314bf47f6a62c79b5d7e554ed59c4","versionType":"git"},{"lessThan":"7a5214dae906d9f58e07bc4995e8181ee74439f4","status":"affected","version":"fc274c1e997314bf47f6a62c79b5d7e554ed59c4","versionType":"git"},{"lessThan":"d026f71df141c9b064ff32a78af5391a31ef75c2","status":"affected","version":"fc274c1e997314bf…

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:706e3492ac5b5e425d6b2b0947bd1d9065ddd2be55a5f95c9a16ad9058f415d3 · sha256:14c42e31d6064d2e… · /containers/cna/affected/0

Affected products and versions

2 source assertions

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:706e3492ac5b5e425d6b2b0947bd1d9065ddd2be55a5f95c9a16ad9058f415d3 · sha256:14c42e31d6064d2e… · /containers/cna/affected/1

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:706e3492ac5b5e425d6b2b0947bd1d9065ddd2be55a5f95c9a16ad9058f415d3 · sha256:14c42e31d6064d2e… · /containers/cna/affected/0

Source references

6 source assertions

{"url":"https://git.kernel.org/stable/c/50eeb8e8a4f389efc91b93cff14a683e714ec194"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:706e3492ac5b5e425d6b2b0947bd1d9065ddd2be55a5f95c9a16ad9058f415d3 · sha256:14c42e31d6064d2e… · /containers/cna/references/0

{"url":"https://git.kernel.org/stable/c/54fa390aae393eb130f307a85562e3001cc39a52"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:706e3492ac5b5e425d6b2b0947bd1d9065ddd2be55a5f95c9a16ad9058f415d3 · sha256:14c42e31d6064d2e… · /containers/cna/references/4

{"url":"https://git.kernel.org/stable/c/67e511d2989eb1c8c588b599ce2fcc6bb8e6f7ea"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:706e3492ac5b5e425d6b2b0947bd1d9065ddd2be55a5f95c9a16ad9058f415d3 · sha256:14c42e31d6064d2e… · /containers/cna/references/5

{"url":"https://git.kernel.org/stable/c/7a5214dae906d9f58e07bc4995e8181ee74439f4"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:706e3492ac5b5e425d6b2b0947bd1d9065ddd2be55a5f95c9a16ad9058f415d3 · sha256:14c42e31d6064d2e… · /containers/cna/references/1

{"url":"https://git.kernel.org/stable/c/b52476a83d9e12df00765359d728a875b128bef1"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:706e3492ac5b5e425d6b2b0947bd1d9065ddd2be55a5f95c9a16ad9058f415d3 · sha256:14c42e31d6064d2e… · /containers/cna/references/3

{"url":"https://git.kernel.org/stable/c/d026f71df141c9b064ff32a78af5391a31ef75c2"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:706e3492ac5b5e425d6b2b0947bd1d9065ddd2be55a5f95c9a16ad9058f415d3 · sha256:14c42e31d6064d2e… · /containers/cna/references/2

Attribution and limitations

CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer