CVE-2026-64453 in Linux
Summary
by MITRE • 07/25/2026
In the Linux kernel, the following vulnerability has been resolved:
usb: misc: usbio: fix disconnect UAF in client teardown
usbio_disconnect() walks usbio->cli_list in reverse and uninitializes each auxiliary device. auxiliary_device_uninit() drops the device reference, and for an unbound child that can run usbio_auxdev_release() and free the containing struct usbio_client.
list_for_each_entry_reverse() advances after the loop body by reading client->link.prev. If the current client is freed by auxiliary_device_uninit(), the iterator dereferences freed memory.
Use list_for_each_entry_safe_reverse() so the previous client is cached before the body can drop the final reference. This preserves reverse teardown order while keeping the next iterator cursor independent of the current client's lifetime.
Validation reproduced this kernel report: BUG: KASAN: slab-use-after-free in usbio_disconnect+0x12e/0x150
Call Trace: <TASK> dump_stack_lvl+0x66/0xa0 print_report+0xce/0x630 ? usbio_disconnect+0x12e/0x150 ? srso_alias_return_thunk+0x5/0xfbef5 ? __virt_addr_valid+0x188/0x320 ? usbio_disconnect+0x12e/0x150 kasan_report+0xe0/0x110 ? usbio_disconnect+0x12e/0x150 usbio_disconnect+0x12e/0x150 usb_unbind_interface+0xf3/0x400 really_probe+0x316/0x660 __driver_probe_device+0x106/0x240 driver_probe_device+0x4a/0x110 __device_attach_driver+0xf1/0x1a0 ? __pfx___device_attach_driver+0x10/0x10 bus_for_each_drv+0xf9/0x160 ? __pfx_bus_for_each_drv+0x10/0x10 ? srso_alias_return_thunk+0x5/0xfbef5 ? trace_hardirqs_on+0x18/0x130 ? srso_alias_return_thunk+0x5/0xfbef5 ? _raw_spin_unlock_irqrestore+0x44/0x60 __device_attach+0x133/0x2a0 ? __pfx___device_attach+0x10/0x10 ? srso_alias_return_thunk+0x5/0xfbef5 ? do_raw_spin_unlock+0x9a/0x100 ? srso_alias_return_thunk+0x5/0xfbef5 device_initial_probe+0x55/0x70 bus_probe_device+0x4a/0xd0 device_add+0x9b9/0xc10 ? __pfx_device_add+0x10/0x10 ? _raw_spin_unlock_irqrestore+0x44/0x60 ? srso_alias_return_thunk+0x5/0xfbef5 ? lockdep_hardirqs_on_prepare+0xea/0x1a0 ? srso_alias_return_thunk+0x5/0xfbef5 ? usb_enable_lpm+0x3c/0x260 usb_set_configuration+0xb64/0xf20 usb_generic_driver_probe+0x5f/0x90 usb_probe_device+0x71/0x1b0 really_probe+0x46b/0x660 __driver_probe_device+0x106/0x240 driver_probe_device+0x4a/0x110 __device_attach_driver+0xf1/0x1a0 ? __pfx___device_attach_driver+0x10/0x10 bus_for_each_drv+0xf9/0x160 ? __pfx_bus_for_each_drv+0x10/0x10 ? srso_alias_return_thunk+0x5/0xfbef5 ? trace_hardirqs_on+0x18/0x130 ? srso_alias_return_thunk+0x5/0xfbef5 ? _raw_spin_unlock_irqrestore+0x44/0x60 __device_attach+0x133/0x2a0 ? __pfx___device_attach+0x10/0x10 ? srso_alias_return_thunk+0x5/0xfbef5 ? do_raw_spin_unlock+0x9a/0x100 ? srso_alias_return_thunk+0x5/0xfbef5 device_initial_probe+0x55/0x70 bus_probe_device+0x4a/0xd0 device_add+0x9b9/0xc10 ? __pfx_device_add+0x10/0x10 ? srso_alias_return_thunk+0x5/0xfbef5 ? add_device_randomness+0xb7/0xf0 usb_new_device+0x492/0x870 hub_event+0x1b10/0x29c0 ? __pfx_hub_event+0x10/0x10 ? srso_alias_return_thunk+0x5/0xfbef5 ? lock_acquire+0x187/0x300 ? process_one_work+0x475/0xb90 ? srso_alias_return_thunk+0x5/0xfbef5 ? lock_release+0xc8/0x290 ? srso_alias_return_thunk+0x5/0xfbef5 process_one_work+0x4d7/0xb90 ? __pfx_process_one_work+0x10/0x10 ? srso_alias_return_thunk+0x5/0xfbef5 ? srso_alias_return_thunk+0x5/0xfbef5 ? __list_add_valid_or_report+0x37/0xf0 ? __pfx_hub_event+0x10/0x10 ? srso_alias_return_thunk+0x5/0xfbef5 worker_thread+0x2d8/0x570 ? __pfx_worker_thread+0x10/0x10 kthread+0x1ad/0x1f0 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x3c9/0x540 ? __pfx_ret_from_fork+0x10/0x10 ? srso_alias_return_thunk+0x5/0xfbef5 ? __switch_to+0x2e9/0x730 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 </TASK>
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/25/2026
The vulnerability addressed in this Linux kernel update relates to a use-after-free condition within the usbio subsystem, specifically during device disconnection operations. This flaw exists in the usbio_disconnect function where the code iterates through a list of client devices using list_for_each_entry_reverse macro. The issue arises because each client device undergoes uninitialization via auxiliary_device_uninit(), which can trigger the release of the containing usbio_client structure, leading to memory corruption when the iterator attempts to access freed memory.
The technical implementation of this vulnerability stems from improper handling of list traversal during reverse iteration. When list_for_each_entry_reverse() processes each client in the cli_list, it advances the iterator by reading client->link.prev after executing the loop body. However, if auxiliary_device_uninit() frees the current client structure, subsequent dereference operations on the iterator become invalid, resulting in a slab-use-after-free error as reported by KASAN. This condition can be exploited to cause system instability or potentially enable privilege escalation.
The operational impact of this vulnerability extends across USB device management within kernel space, affecting any system utilizing USB devices that support the usbio subsystem. The flaw can manifest during normal USB device disconnection events, particularly when multiple auxiliary devices are present and undergoing teardown simultaneously. The call trace demonstrates how the issue propagates through the USB subsystem including device binding/unbinding operations, driver probing, and device initialization routines, indicating this vulnerability affects core USB infrastructure components.
This vulnerability aligns with CWE-416, Use After Free, which describes a condition where a program continues to use a pointer after it has been freed. The fix implements list_for_each_entry_safe_reverse() instead of the unsafe list_for_each_entry_reverse(), ensuring that the previous client reference is cached before any potential memory deallocation occurs during the loop body execution. This approach maintains the required reverse teardown order while decoupling iterator advancement from the lifetime of the current element, preventing access to freed memory structures.
The mitigation strategy follows established kernel security practices for list traversal operations and aligns with ATT&CK technique T1068, Exploitation for Privilege Escalation. By using the safe reverse iteration macro, the fix prevents the kernel from accessing deallocated memory structures during device teardown operations. This remediation ensures that USB device management remains stable even when multiple auxiliary devices are being disconnected simultaneously, preserving system integrity while maintaining the expected operational behavior of the usbio subsystem.
The validation process confirmed this vulnerability through KASAN reporting the specific error location at usbio_disconnect+0x12e/0x150, providing clear evidence of the memory corruption occurring during reverse list traversal. The comprehensive call trace demonstrates the propagation path through the USB subsystem and highlights that this issue affects critical kernel components including device management, driver binding, and USB configuration handling, making it a significant security concern for Linux systems utilizing USB peripherals.