CVE-2026-64453
HIGH 7.8 ALL-YEARSIn the Linux kernel, the following vulnerability has been resolved: usb: misc: usbio: fix disconnect UAF in client teardown usbio_disconnect() walks usbio->cli_list in reverse and uninitializes each auxiliary device. auxiliary_device_uninit() drops the device reference, and for an unbound child that can run usbio_auxdev_release() and free the containing struct usbio_client. list_for_each_entry_reverse() advances after the loop body by reading client->link.prev. If the current client is freed by auxiliary_device_uninit(), the iterator dereferences freed memory. Use list_for_each_entry_safe_reverse() so the previous client is cached before the body can drop the final reference. This preserves reverse teardown order while keeping the next iterator cursor independent of the current client's lifetime. Validation reproduced this kernel report: BUG: KASAN: slab-use-after-free in usbio_disconnect+0x12e/0x150 Call Trace: <TASK> dump_stack_lvl+0x66/0xa0 print_report+0xce/0x630 ? usbio_disconnect+0x12e/0x150 ? srso_alias_return_thunk+0x5/0xfbef5 ? __virt_addr_valid+0x188/0x320 ? usbio_disconnect+0x12e/0x150 kasan_report+0xe0/0x110 ? usbio_disconnect+0x12e/0x150 usbio_disconnect+0x12e/0x150 usb_unbind_interface+0xf3/0x400 really_probe+0x316/0x660 __driver_probe_device+0x106/0x240 driver_probe_device+0x4a/0x110 __device_attach_driver+0xf1/0x1a0 ? __pfx___device_attach_driver+0x10/0x10 bus_for_each_drv+0xf9/0x160 ? __pfx_bus_for_each_drv+0x10/0x10 ? srso_alias_retu
Severe if exploited (CVSS 7.8), but no confirmed exploitation. Patch on a normal cadence.
Exploitation likelihood
0.2%chance of exploitation in 30 days · 6th percentile
Impact if exploited
7.8CVSS 3.1 · HIGH · NVD
- ConfidentialityHigh
- IntegrityHigh
- AvailabilityHigh
What an attacker needs
- ⚠Access: Requires local access to the host
- ⚠Privileges: Requires a low-privilege account
- ✓User interaction: No user interaction needed
- ✓Complexity: No special conditions — reliably repeatable
✓ lowers the bar for an attacker · ⚠ raises it
Proof of concept
No public PoC is currently catalogued.
Search for new PoCs
Search GitHub now — results may be empty or unverified.
Tracked sources are checked weekly for the full archive, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.
Weakness (CWE)
- CWE-416: Use after free
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References and research data (JSON)
Vendor product assessments
Showing 32 of 274 vendor product statements; 242 omitted. Read the full vendor advisory.
kernel as a component of Red Hat Enterprise Linux 10 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel
- none available: Fix deferred
kernel-64k-debug-devel as a component of Red Hat Enterprise Linux 10 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-64k-debug-devel
- none available: Fix deferred
kernel-64k-devel as a component of Red Hat Enterprise Linux 10 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-64k-devel
- none available: Fix deferred
kernel-abi-stablelists as a component of Red Hat Enterprise Linux 10 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-abi-stablelists
- none available: Fix deferred
kernel-debug-devel-matched as a component of Red Hat Enterprise Linux 10 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-debug-devel-matched
- none available: Fix deferred
kernel-devel as a component of Red Hat Enterprise Linux 10 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-devel
- none available: Fix deferred
kernel-modules-extra as a component of Red Hat Enterprise Linux 10 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-modules-extra
- none available: Fix deferred
kernel-rt-64k-debug as a component of Red Hat Enterprise Linux 10 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-rt-64k-debug
- none available: Fix deferred
kernel-rt-64k-debug-modules-extra as a component of Red Hat Enterprise Linux 10 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-rt-64k-debug-modules-extra
- none available: Fix deferred
kernel-rt-core as a component of Red Hat Enterprise Linux 10 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-rt-core
- none available: Fix deferred
kernel-rt-debug-modules as a component of Red Hat Enterprise Linux 10 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-rt-debug-modules
- none available: Fix deferred
kernel-rt-modules as a component of Red Hat Enterprise Linux 10 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-rt-modules
- none available: Fix deferred
kernel-tools-libs-devel as a component of Red Hat Enterprise Linux 10 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-tools-libs-devel
- none available: Fix deferred
kernel-zfcpdump-devel as a component of Red Hat Enterprise Linux 10 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-zfcpdump-devel
- none available: Fix deferred
kernel.src as a component of Red Hat Enterprise Linux 10 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel?arch=src
- none available: Fix deferred
rv as a component of Red Hat Enterprise Linux 10 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/rv
- none available: Fix deferred
kernel as a component of Red Hat Enterprise Linux 6 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel
Red Hat · CVE-2026-64453 · Updated 2026-09-03T15:31:43+00:00python-perf as a component of Red Hat Enterprise Linux 6 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/python-perf
Red Hat · CVE-2026-64453 · Updated 2026-09-03T15:31:43+00:00kernel-rt-debug as a component of Red Hat Enterprise Linux 7 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-rt-debug
Red Hat · CVE-2026-64453 · Updated 2026-09-03T15:31:43+00:00kernel.src as a component of Red Hat Enterprise Linux 7 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel?arch=src
Red Hat · CVE-2026-64453 · Updated 2026-09-03T15:31:43+00:00kernel-debug-modules-internal as a component of Red Hat Enterprise Linux 8 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-debug-modules-internal
Red Hat · CVE-2026-64453 · Updated 2026-09-03T15:31:43+00:00kernel-rt-debug-kvm as a component of Red Hat Enterprise Linux 8 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-rt-debug-kvm
Red Hat · CVE-2026-64453 · Updated 2026-09-03T15:31:43+00:00kernel-tools-libs as a component of Red Hat Enterprise Linux 8 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-tools-libs
Red Hat · CVE-2026-64453 · Updated 2026-09-03T15:31:43+00:00kernel-64k as a component of Red Hat Enterprise Linux 9 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-64k
Red Hat · CVE-2026-64453 · Updated 2026-09-03T15:31:43+00:00kernel-64k-modules as a component of Red Hat Enterprise Linux 9 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-64k-modules
Red Hat · CVE-2026-64453 · Updated 2026-09-03T15:31:43+00:00kernel-debug-modules-core as a component of Red Hat Enterprise Linux 9 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-debug-modules-core
Red Hat · CVE-2026-64453 · Updated 2026-09-03T15:31:43+00:00kernel-modules-extra as a component of Red Hat Enterprise Linux 9 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-modules-extra
Red Hat · CVE-2026-64453 · Updated 2026-09-03T15:31:43+00:00kernel-rt-64k-debug-modules-extra as a component of Red Hat Enterprise Linux 9 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-rt-64k-debug-modules-extra
Red Hat · CVE-2026-64453 · Updated 2026-09-03T15:31:43+00:00kernel-rt-debug-devel as a component of Red Hat Enterprise Linux 9 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-rt-debug-devel
Red Hat · CVE-2026-64453 · Updated 2026-09-03T15:31:43+00:00kernel-rt-modules-extra as a component of Red Hat Enterprise Linux 9 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-rt-modules-extra
Red Hat · CVE-2026-64453 · Updated 2026-09-03T15:31:43+00:00kernel-zfcpdump-devel as a component of Red Hat Enterprise Linux 9 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-zfcpdump-devel
Red Hat · CVE-2026-64453 · Updated 2026-09-03T15:31:43+00:00rv as a component of Red Hat Enterprise Linux 9 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/rv
Red Hat · CVE-2026-64453 · Updated 2026-09-03T15:31:43+00:00
Known Affected Software Configurations
| Vendor | Product | Version range |
|---|---|---|
| Linux | Linux Kernel | ≥ 6.18 and < 6.18.39 |
| Linux | Linux Kernel | ≥ 6.19 and < 7.1.4 |
| Linux | Linux Kernel | 7.2 |
| Linux | Linux Kernel | 7.2 |
References
Patches & mitigations
- https://git.kernel.org/stable/c/c40090f8d19b415e2925b22be964b5d1f695666f CVE record · Linux · Updated 2026-08-17T04:55:57.317Z
NVD · CVE-2026-64453 · Updated 2026-09-03T14:45:03.570 - https://git.kernel.org/stable/c/1947b6411460d68b54b13c536961933166937d05 CVE record · Linux · Updated 2026-08-17T04:55:57.317Z
NVD · CVE-2026-64453 · Updated 2026-09-03T14:45:03.570 - https://git.kernel.org/stable/c/0bfeec21984fedd32987f4e4c0cde34b445af404 CVE record · Linux · Updated 2026-08-17T04:55:57.317Z
NVD · CVE-2026-64453 · Updated 2026-09-03T14:45:03.570
Advisories
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64453.json Red Hat · CVE-2026-64453 · Updated 2026-09-03T15:31:43+00:00
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-48797 EUVD · EUVD-2026-48797
Technical & other
- https://access.redhat.com/security/cve/CVE-2026-64453 Red Hat · CVE-2026-64453 · Updated 2026-09-03T15:31:43+00:00
- https://bugzilla.redhat.com/show_bug.cgi?id=2507084 Red Hat · CVE-2026-64453 · Updated 2026-09-03T15:31:43+00:00
- https://www.cve.org/CVERecord?id=CVE-2026-64453 Red Hat · CVE-2026-64453 · Updated 2026-09-03T15:31:43+00:00
- https://nvd.nist.gov/vuln/detail/CVE-2026-64453 Red Hat · CVE-2026-64453 · Updated 2026-09-03T15:31:43+00:00
- https://lore.kernel.org/linux-cve-announce/2026072541-CVE-2026-64453-aaa1@gregkh/T Red Hat · CVE-2026-64453 · Updated 2026-09-03T15:31:43+00:00
Sources: NVD · CVE.org · All sources and attribution · EPSS