CVE-2026-64340

CVE-2026-64340 is a use-after-free in the Linux kernel's USB legousbtower driver caused by a race between release() and disconnect(). The root cause is that mutex_unlock() can access the mutex structure after the lock is released, making it unsafe for object lifetime management. The fix introduce...

PT-2026-64561

In the Linux kernel, the following vulnerability has been resolved: USB: legousbtower: fix use-after-free on disconnect race mutex unlock may access the mutex structure after releasing the lock and therefore cannot be used to manage lifetime of objects directly unlike spinlocks and refcounts. 12...