PT-2026-64675

In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: run gadget disconnect from sleepable suspend context dwc3 gadget suspend takes dwc-lock with IRQs disabled and then calls dwc3 disconnect gadget. For async callbacks that helper only uses plain spin unlock/spin lock, s...

Linux Distros Unpatched Vulnerability : CVE-2026-64346

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - usb: gadget: udc: Fix use-after-free in gadgetmatchdriver The udc structure acts as the management structure for the gadget, but their lifecycles are decoupled....

Linux Distros Unpatched Vulnerability : CVE-2026-64328

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - usb: gadget: ffs: Fix DMA fence leak In ffsdmabuftransfer, a ffsdmafence object is kmalloc'd, with the underlying dmafence later initialized by dmafenceinit,...

Linux Distros Unpatched Vulnerability : CVE-2026-64347

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - usb: gadget: composite: fix dead empty check in the USBDTOTG handler The OTG branch of compositesetup falls back to the first configuration when none is...

Linux Distros Unpatched Vulnerability : CVE-2026-64454

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - usb: dwc3: run gadget disconnect from sleepable suspend context dwc3gadgetsuspend takes dwc-lock with IRQs disabled and then calls dwc3disconnectgadget. For asy...

PT-2026-64567

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the USB gadget UDC management where the lifecycles of the gadget and the udc structure are decoupled. This occurs when usb del gadget frees the udc memory whil...

PT-2026-64558

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the usb mtu3 component where the mtu3 gadget queue function maps a request before verifying if the QMU GPD ring can accept another transfer. If the mtu3 prepare transf...

GHSA-GF8H-GQ53-288J OpenAM: WebAuthn Java deserialization RCE via ObjectInputFilter depth>1 bypass

Summary The GHSA-6c99-87fr-6q7r fix wrapped WebAuthn authenticator deserialization in an ObjectInputFilter meant to allow only AuthenticatorImpl, but it short-circuits to ALLOWED for any object at stream depth 1. Because the Java serialization filter is consulted for every class in the graph and...

OpenAM: WebAuthn Java deserialization RCE via ObjectInputFilter depth>1 bypass

Summary The GHSA-6c99-87fr-6q7r fix wrapped WebAuthn authenticator deserialization in an ObjectInputFilter meant to allow only AuthenticatorImpl, but it short-circuits to ALLOWED for any object at stream depth 1. Because the Java serialization filter is consulted for every class in the graph and...

CVE-2026-64242

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: net2280: Fix double free in probe error path usbinitializegadget installs gadgetrelease as the release callback for the embedded gadget device. The struct net2280 instance is therefore released through gadgetrelease...

DEBIAN-CVE-2026-64242

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: net2280: Fix double free in probe error path usbinitializegadget installs gadgetrelease as the release callback for the embedded gadget device. The struct net2280 instance is therefore released through gadgetrelease...

CVE-2026-64233

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: uvc: hold opts-lock across XU walks in uvcfunctionbind uvcfunctionbind walks &opts-extensionunits twice without holding opts-lock: - directly, for the iExtension string-descriptor fixup loop; - indirectly, four times...

CVE-2026-64242

The CVE-2026-64242 issue affects the Linux kernel USB gadget net2280 driver. A double free could occur in the probe error path: usb_initialize_gadget() registers gadget_release() as the release callback, so net2280 is freed via gadget_release() when the gadget reference drops. The probe error pat...

CVE-2026-64242

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: net2280: Fix double free in probe error path usbinitializegadget installs gadgetrelease as the release callback for the embedded gadget device. The struct net2280 instance is therefore released through gadgetrelease...

EUVD-2026-48651

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: net2280: Fix double free in probe error path usbinitializegadget installs gadgetrelease as the release callback for the embedded gadget device. The struct net2280 instance is therefore released through gadgetrelease...

CVE-2026-64242 usb: gadget: net2280: Fix double free in probe error path

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: net2280: Fix double free in probe error path usbinitializegadget installs gadgetrelease as the release callback for the embedded gadget device. The struct net2280 instance is therefore released through gadgetrelease...

CVE-2026-64242 usb: gadget: net2280: Fix double free in probe error path

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: net2280: Fix double free in probe error path usbinitializegadget installs gadgetrelease as the release callback for the embedded gadget device. The struct net2280 instance is therefore released through gadgetrelease...

CVE-2026-64233

The CVE-2026-64233 issue affects the Linux kernel USB Video Class (UVC) gadget driver. A race during function binding can occur when a privileged user holds a configfs subtree open and concurrently removes an extensions subdirectory, because uvc_function_bind() walks opts->extension_units with...

EUVD-2026-48642

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: uvc: hold opts-lock across XU walks in uvcfunctionbind uvcfunctionbind walks &opts-extensionunits twice without holding opts-lock: - directly, for the iExtension string-descriptor fixup loop; - indirectly, four times...

CVE-2026-64233 usb: gadget: uvc: hold opts->lock across XU walks in uvc_function_bind

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: uvc: hold opts-lock across XU walks in uvcfunctionbind uvcfunctionbind walks &opts-extensionunits twice without holding opts-lock: - directly, for the iExtension string-descriptor fixup loop; - indirectly, four times...