CVE-2026-64242

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A double free issue exists in the net2280 USB gadget driver. The usb initialize gadget() function sets gadget release() as the release callback for the embedded gadget device, meaning the net2280 instance is released via this callback when the last reference is dropped. During a probe error, the net2280 remove() function is called to tear down the partially initialized device and drops the gadget reference using usb put gadget(). If kfree(dev) is called immediately after, the same object is freed twice.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.