CVE-2026-64453

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A use-after-free (UAF) issue exists in the usbio disconnect() function during client teardown. The function iterates through the usbio->cli list in reverse to uninitialize auxiliary devices. When auxiliary device uninit() is called, it drops the device reference, which can trigger usbio auxdev release() and free the usbio client structure. Because the loop uses list for each entry reverse(), it attempts to read the client->link.prev pointer after the current client has been freed, leading to a memory dereference of freed memory.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.