CVE-2026-64242

usb: gadget: net2280: Fix double free in probe error path

HIGH

7.8

CVSS Score

Published: July 24, 2026 at 03:27 PM UTC

Updated: August 13, 2026 at 05:37 PM UTC

1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH7.8

Exploit prediction

EPSS 0.1%

Description

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: net2280: Fix double free in probe error path usb_initialize_gadget() installs gadget_release() as the release callback for the embedded gadget device. The struct net2280 instance is therefore released through gadget_release() when the gadget device's last reference is dropped. The probe error path calls net2280_remove(), which tears down the partially initialized device and drops the gadget reference with usb_put_gadget(). Calling kfree(dev) afterwards can free the same object again. Drop the explicit kfree() and let the gadget device release callback handle the final free. This issue was found by a static analysis tool I am developing.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Linux Kernel · Linux

95%

5.10 ≤ v < 5.10.2595.10 ≤ v < 5.15.2105.10 ≤ v < 6.1.1765.10 ≤ v < 6.12.935.10 ≤ v < 6.18.355.10 ≤ v < 6.6.1435.10 ≤ v < 7.0.125.10 ≤ v < 7.15.11 ≤ v < 5.15.2105.16 ≤ v < 6.1.1766.13 ≤ v < 6.18.356.19 ≤ v < 7.0.126.2 ≤ v < 6.6.1436.7 ≤ v < 6.12.937.1 rc1 7.1 rc2 7.1 rc3 7.1 rc4 7.1 rc5f770fbec4165b1acfabdeadb01ad6008d2c537b5

Vendor states this is fixed in 085652fda7f38040d1a2c42d72614f418feb843f (fixed)

Vendor states this is fixed in 48f89ead20e48d447ad29fa937b43b9fa981cf28 (fixed)

Vendor states this is fixed in 550fa4d071a8c8e53072900869d37ae6abf4999d (fixed)

Vendor states this is fixed in 71b3391dc81655ff058492f8e9d013b2c6e5747b (fixed)

Vendor states this is fixed in c5b9fdb1e8ddf50bc6272927edb118679f170350 (fixed)

Vendor states this is fixed in c8547c74988e0b5f4cbb1b895e2a57aae084f070 (fixed)

Vendor states this is fixed in db2b72e83a0208ae2b3b270bf91662b1c6849a9b (fixed)

Vendor states this is fixed in e6f8be12f0307145b9a6010f044925952b37de8b (fixed)

Vendor states this is fixed in 5.10 (unaffected)

Vendor states this is fixed in 5.10.259 (unaffected)

Vendor states this is fixed in 5.15.210 (unaffected)

Vendor states this is fixed in 6.1.176 (unaffected)