CVE-2026-64242 usb: gadget: net2280: Fix double free in probe error path
A double free vulnerability in the Linux kernel net2280 USB gadget driver allows attackers to cause denial of service or potentially execute code via a crafted probe error path.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-64242?
CVE-2026-64242 is a high-severity use after free vulnerability in Linux kernel, published on 24 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: net2280: Fix double free in probe error path
usb_initialize_gadget() installs gadget_release() as the release callback for the embedded gadget device. The struct net2280 instance is therefore released through gadget_release() when the gadget device's last reference is dropped.
The probe error path calls net2280_remove(), which tears down the partially initialized device and drops the gadget reference with usb_put_gadget(). Calling kfree(dev) afterwards can free the same object again.
Drop the explicit kfree() and let the gadget device release callback handle the final free. This issue was found by a static analysis tool I am developing.
Weakness: CWE-415
Which versions are affected by CVE-2026-64242?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-64242?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-64242 being exploited?
There is no known exploitation of CVE-2026-64242 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-64242, DEBIAN-CVE-2026-64242, GHSA-6mf3-xx2m-8j4w, ROOT-OS-UBUNTU-2204-CVE-2026-64242, UBUNTU-CVE-2026-64242.