CVE-2026-64242 in Linux
Summary
by MITRE • 07/24/2026
In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: net2280: Fix double free in probe error path
usb_initialize_gadget() installs gadget_release() as the release callback for the embedded gadget device. The struct net2280 instance is therefore released through gadget_release() when the gadget device's last reference is dropped.
The probe error path calls net2280_remove(), which tears down the partially initialized device and drops the gadget reference with usb_put_gadget(). Calling kfree(dev) afterwards can free the same object again.
Drop the explicit kfree() and let the gadget device release callback handle the final free. This issue was found by a static analysis tool I am developing.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/24/2026
This vulnerability resides in the linux kernel's usb gadget framework specifically affecting the net2280 driver implementation. The flaw manifests as a double free condition that occurs during the device probe error path, representing a critical memory management issue that can lead to system instability and potential exploitation. The vulnerability is classified under cwe-415 as an improper cleanup of memory resources, where the same memory object gets freed twice through different code paths.
The technical implementation involves the usb_initialize_gadget() function which establishes gadget_release() as the release callback for the embedded gadget device structure. This callback mechanism ensures proper cleanup when the gadget device's reference count drops to zero. However, during probe failure scenarios, the code executes net2280_remove() function that performs partial teardown operations and subsequently calls usb_put_gadget() to drop the gadget reference. The problematic sequence occurs because the code then explicitly calls kfree(dev) afterward, attempting to free memory that has already been released through the gadget device's release callback mechanism.
The operational impact of this vulnerability extends beyond simple memory corruption as it represents a fundamental race condition and resource management flaw within the kernel's usb subsystem. When the double free occurs, it creates potential for heap corruption that could be leveraged by malicious actors to execute arbitrary code or cause denial of service conditions. The static analysis tool that discovered this issue highlights the sophisticated nature of modern vulnerability detection methods that can identify such subtle memory management errors before they are exploited in the wild.
This particular vulnerability aligns with attack patterns documented in the mitre att&ck framework under the system service execution and privilege escalation domains, where kernel-level memory corruption can provide attackers with elevated privileges. The fix implemented involves removing the explicit kfree() call from the probe error path and allowing the established gadget device release callback to handle all final memory cleanup operations, ensuring proper single-free semantics throughout the device lifecycle management.
The resolution addresses a fundamental flaw in the usb gadget driver's resource management architecture by maintaining consistency with established kernel patterns where reference counting and callback mechanisms provide reliable cleanup guarantees. This approach aligns with kernel development best practices that emphasize proper use of reference counting and callback infrastructure rather than manual memory management, which reduces the attack surface and prevents similar issues from occurring in other parts of the usb subsystem. The fix demonstrates the importance of maintaining consistency in kernel memory management patterns and validates the effectiveness of automated static analysis tools in identifying subtle but critical vulnerabilities before they can be exploited in production environments.