{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-64455 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2026-64455 is an use after free vulnerability in Linux, published on 25 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-64455 and fix it if it is affected.\n\nWhat it is: CVE-2026-64455 is an use after free vulnerability in Linux, published on 25 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-64455 in the wild and no public exploit code.\n\nAffected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-64455/ (Markdown: https://insights.sbomify.com/CVE-2026-64455/index.md)","id":"CVE-2026-64455","markdown":"https://insights.sbomify.com/CVE-2026-64455/index.md","name":"CVE-2026-64455","record":{"aliases":["BELL-CVE-2026-64455","DEBIAN-CVE-2026-64455","GHSA-w6hm-pc27-4xcr","ROOT-OS-UBUNTU-2204-CVE-2026-64455","UBUNTU-CVE-2026-64455"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["denial_of_service","code_execution"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Linux kernel USB driver","requires_auth":"low_privilege","summary":"A use-after-free in the Linux kernel chaoskey USB driver allows local attackers to cause a system crash or potentially execute code by closing the device file after unplugging.","user_interaction":"not_required","vuln_class":"use_after_free"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: chaoskey: Fix slab-use-after-free in chaoskey_release()\n\nThe chaoskey driver has a use-after-free bug in its release routine.\nIf the user closes the device file after the USB device has been\nunplugged, a debugging log statement will try to access the\nusb_interface structure after it has been deallocated:\n\n\tBUG: KASAN: slab-use-after-free in dev_driver_string (drivers/base/core.c:2406)\n\tRead of size 8 at addr ffff888168e8a0b8 by task chaoskey_raw_re/10106\n\n\tHardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n\tCall Trace:\n\t \u003cTASK\u003e\n\t dump_stack_lvl (lib/dump_stack.c:94 lib/dump_stack.c:120)\n\t print_report (mm/kasan/report.c:378 mm/kasan/report.c:482)\n\t kasan_report (mm/kasan/report.c:595)\n\t dev_driver_string (drivers/base/core.c:2406)\n\t __dynamic_dev_dbg (lib/dynamic_debug.c:906)\n\t chaoskey_release (drivers/usb/misc/chaoskey.c:323)\n\t __fput (fs/file_table.c:510)\n\t fput_close_sync (fs/file_table.c:615)\n\t __x64_sys_close (fs/open.c:1507 fs/open.c:1492 fs/open.c:1492)\n\t do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94)\n\t entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)\n\nThe driver's last reference to the interface structure is dropped in\nthe chaoskey_free() routine, so the code must not use the interface --\neven in a debugging statement -- after that routine returns.\n(Exception: If we know that another reference is held by someone else,\nsuch as the device core while the disconnect routine runs, there's no\nproblem.  Thanks to Johan Hovold for pointing this out.)\n\nSince the bad access is part of an unimportant debugging statement,\nwe can fix the problem simply by removing the whole statement.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"USB: chaoskey: Fix slab-use-after-free in chaoskey_release()","id":"CVE-2026-64455","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"use_after_free","year":"2026"},"n_packages":0,"n_references":8,"next":{"headline":"hwrng: virtio: clamp device-reported used.len at copy_data()","id":"CVE-2026-64456"},"packages":[],"prev":{"headline":"usb: dwc3: run gadget disconnect from sleepable suspend context","id":"CVE-2026-64454"},"products":["Linux"],"published":"2026-07-25","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-08-17","vendors":["Linux"]},"summary":"A use-after-free in the Linux kernel chaoskey USB driver allows local attackers to cause a system crash or potentially execute code by closing the device file after unplugging.","url":"https://insights.sbomify.com/CVE-2026-64455/"}