CVE-2026-64345

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_printer: take kref only for successful open printer_open() returns -EBUSY when the character device is already open, but it increments dev->kref regardless of the return value. VFS does not call ->release() for a failed open, so every rejected second open permanently leaks one reference. Move kref_get() into the successful-open branch.

CVSS v3 5.5 MEDIUM

5.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://git.kernel.org/stable/c/30adce93d5c4a5a1ec29d9249e3fdfcc391d406b	Patch
https://git.kernel.org/stable/c/75c0ad13e136961328253742501b4efc3988a587	Patch
https://git.kernel.org/stable/c/7f1f24c367938c5537e2308bf9a965f051d14774	Patch
https://git.kernel.org/stable/c/8a5eba992c862b0c94411eecf9b7121e8636db38	Patch
https://git.kernel.org/stable/c/94ec20d97aa51547965a539f660a1fe79c6929a3	Patch
https://git.kernel.org/stable/c/bf20c94fa6aaff945f0ae3a23f3212cd299f28d9	Patch

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel:7.2:rc1::::::
	cpe:2.3:o:linux:linux_kernel:7.2:rc2::::::

History

No history.

Information

Published : 2026-07-25 10:17

Updated : 2026-09-03 16:01

NVD link : CVE-2026-64345

Mitre link : CVE-2026-64345

CVE.ORG link : CVE-2026-64345

JSON object : View

Products Affected

linux

linux_kernel

CWE

NVD-CWE-noinfo

{"id": "CVE-2026-64345", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "e8d5f92b8d30bb4ade76494490c3c065e12411b1", "lessThan": "94ec20d97aa51547965a539f660a1fe79c6929a3", "versionType": "git"}, {"status": "affected", "version": "e8d5f92b8d30bb4ade76494490c3c065e12411b1", "lessThan": "75c0ad13e136961328253742501b4efc3988a587", "versionType": "git"}, {"status": "affected", "version": "e8d5f92b8d30bb4ade76494490c3c065e12411b1", "lessThan": "bf20c94fa6aaff945f0ae3a23f3212cd299f28d9", "versionType": "git"}, {"status": "affected", "version": "e8d5f92b8d30bb4ade76494490c3c065e12411b1", "lessThan": "8a5eba992c862b0c94411eecf9b7121e8636db38", "versionType": "git"}, {"status": "affected", "version": "e8d5f92b8d30bb4ade76494490c3c065e12411b1", "lessThan": "7f1f24c367938c5537e2308bf9a965f051d14774", "versionType": "git"}, {"status": "affected", "version": "e8d5f92b8d30bb4ade76494490c3c065e12411b1", "lessThan": "30adce93d5c4a5a1ec29d9249e3fdfcc391d406b", "versionType": "git"}, {"status": "affected", "version": "25c95c6bd4dc50a3c20de0fa7f450ea02b2320fc", "versionType": "git"}, {"status": "affected", "version": "4a47581cf010dc351d8069978080fdb000c0776d", "versionType": "git"}, {"status": "affected", "version": "d9fe88b2a38dc700bf5bd3a09c7cd11bbc248367", "versionType": "git"}, {"status": "affected", "version": "cedb0187b8ba929c3f76f28e6bc25804d65f8a54", "versionType": "git"}, {"status": "affected", "version": "e9e791f5c39ab30e374a3b1a9c25ca7ff24988f3", "versionType": "git"}, {"status": "affected", "version": "34f026263889e2827e04acdc3a0eb9ecbd191ef0", "versionType": "git"}, {"status": "affected", "version": "5f845e5d18d151230476cf90aa46449f69ba2ef1", "versionType": "git"}, {"status": "affected", "version": "4.4.241", "lessThan": "4.5", "versionType": "semver"}, {"status": "affected", "version": "4.9.241", "lessThan": "4.10", "versionType": "semver"}, {"status": "affected", "version": "4.14.203", "lessThan": "4.15", "versionType": "semver"}, {"status": "affected", "version": "4.19.154", "lessThan": "4.20", "versionType": "semver"}, {"status": "affected", "version": "5.4.73", "lessThan": "5.5", "versionType": "semver"}, {"status": "affected", "version": "5.8.17", "lessThan": "5.9", "versionType": "semver"}, {"status": "affected", "version": "5.9.2", "lessThan": "5.10", "versionType": "semver"}], "programFiles": ["drivers/usb/gadget/function/f_printer.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.10"}, {"status": "unaffected", "version": "0", "lessThan": "5.10", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.261", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "6.6.145", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.96", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.39", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.1.4", "versionType": "semver", "lessThanOrEqual": "7.1.*"}, {"status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/usb/gadget/function/f_printer.c"], "defaultStatus": "affected"}]}], "published": "2026-07-25T10:17:16.623", "references": [{"url": "https://git.kernel.org/stable/c/30adce93d5c4a5a1ec29d9249e3fdfcc391d406b", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/75c0ad13e136961328253742501b4efc3988a587", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/7f1f24c367938c5537e2308bf9a965f051d14774", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/8a5eba992c862b0c94411eecf9b7121e8636db38", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/94ec20d97aa51547965a539f660a1fe79c6929a3", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/bf20c94fa6aaff945f0ae3a23f3212cd299f28d9", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: f_printer: take kref only for successful open\n\nprinter_open() returns -EBUSY when the character device is already\nopen, but it increments dev->kref regardless of the return value. VFS\ndoes not call ->release() for a failed open, so every rejected second\nopen permanently leaks one reference.\n\nMove kref_get() into the successful-open branch."}], "lastModified": "2026-09-03T16:01:24.487", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C6FE8C96-D0D0-494D-9E39-A26AF025BE5F", "versionEndExcluding": "4.5", "versionStartIncluding": "4.4.241"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "653FAD53-20AC-45CC-8502-07F428507BE5", "versionEndExcluding": "4.10", "versionStartIncluding": "4.9.241"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "27A7D190-0093-49D0-BC13-C06D04205CB3", "versionEndExcluding": "4.15", "versionStartIncluding": "4.14.203"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4419ADA7-AD12-407A-8F3E-70B31B5BCE1C", "versionEndExcluding": "4.20", "versionStartIncluding": "4.19.154"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "886AB560-B760-44F0-AD89-3F275E4C0F58", "versionEndExcluding": "5.5", "versionStartIncluding": "5.4.73"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BEFC3ACE-365D-48E7-9C0A-019C74CC0725", "versionEndExcluding": "5.9", "versionStartIncluding": "5.8.17"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "33F9E637-BEB1-4729-8611-B1133AE12A0F", "versionEndExcluding": "5.10.261", "versionStartIncluding": "5.9.2"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CA9CEC46-431F-4DB2-AFC6-D1CE68AD27CA", "versionEndExcluding": "6.6.145", "versionStartIncluding": "5.11"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "38A8100E-2B1A-462F-AEE9-8901B870FEF2", "versionEndExcluding": "6.12.96", "versionStartIncluding": "6.7"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "914AE4BC-3D59-4C5A-9DB5-9CE327B429F7", "versionEndExcluding": "6.18.39", "versionStartIncluding": "6.13"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6228DDD6-4557-4AA3-9F43-AB995D471E42", "versionEndExcluding": "7.1.4", "versionStartIncluding": "6.19"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.2:rc1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5E8B9085-7ADB-4A05-89EF-12949B6A0509"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.2:rc2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1FC0D50D-9D58-4947-A197-A5A3FF07E7E3"}], "operator": "OR"}]}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}