Skip to content
Heist/ feed
UnratedFix available

USB: chaoskey: Fix slab-use-after-free in chaoskey_release()

Type: advisorySource: OSV1 source record

In the Linux kernel, the following vulnerability has been resolved: USB: chaoskey: Fix slab-use-after-free in chaoskey_release() The chaoskey driver has a use-after-free bug in its release routine. If the user closes the device file after the USB device has been unplugged, a debugging log statement will try to access the usb_interface structure after it has been deallocated: BUG: KASAN: slab-use-after-free in dev_driver_string (drivers/base/core.c:2406) Read of size 8 at addr ffff888168e8a0b8 by task chaoskey_raw_re/10106 Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Call Trace: dump_stack_lvl (lib/dump_stack.c:94 lib/dump_stack.c:120) print_report (mm/kasan/report.c:378 mm/kasan/report.c:482) kasan_report (mm/kasan/report.c:595) dev_driver_string (drivers/base/core.c:2406) __dynamic_dev_dbg (lib/dynamic_debug.c:906) chaoskey_release (drivers/usb/misc/chaoskey.c:323) __fput (fs/file_table.c:510) fput_close_sync (fs/file_table.c:615) __x64_sys_close (fs/open.c:1507 fs/open.c:1492 fs/open.c:1492) do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121) The driver's last reference to the interface structure is dropped in the chaoskey_free() routine, so the code must not use the interface -- even in a debugging statement -- after that routine returns. (Exception: If we know that another reference is held by someone else, such as

Announced Group revision 1
Original source ↗

CVE-2026-64455

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:CVE-2026-64455

Kernel

Source reference: /affected/1/package/name

Affected versions
Not stated in this record
Fixed versions
5.10.261

Source reference: /affected/1/ranges

5.15.212

Source reference: /affected/1/ranges

6.1.178

Source reference: /affected/1/ranges

6.6.145

Source reference: /affected/1/ranges

6.12.96

Source reference: /affected/1/ranges

6.18.39

Source reference: /affected/1/ranges

7.1.4

Source reference: /affected/1/ranges

Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
        "type": "GIT",
        "events": [
          {
            "introduced": "66e3e591891da9899a8990792da080432531ffd4"
          },
          {
            "fixed": "fe7a0f4be283b40dd592540027279735120d0d6f"
          },
          {
            "fixed": "5ec61fbef9ec5635c492ae63dfb5d13f2bdf1023"
          },
          {
            "fixed": "f3e409476ad0703c54c14f245e4e143c8124e1bd"
          },
          {
            "fixed": "6c82f88bc7a8458d5c60f9b354c4d32d233f0cac"
          },
          {
            "fixed": "3ad5fbcced4e9c2b0fee3c1b76289a147fc35b89"
          },
          {
            "fixed": "2a52d55c86a429dac47886b8424e67f90b001e67"
          },
          {
            "fixed": "8f50613bff228272577893aa10a346a2f3063e49"
          },
          {
            "fixed": "abf76d3239dee97b66e7241ad04811f1ce562e28"
          }
        ]
      }
    ],
    "database_specific": {
      "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-64455.json"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "4.1.0"
          },
          {
            "fixed": "5.10.261"
          }
        ]
      },
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "5.11.0"
          },
          {
            "fixed": "5.15.212"
          }
        ]
      },
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "5.16.0"
          },
          {
            "fixed": "6.1.178"
          }
        ]
      },
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "6.2.0"
          },
          {
            "fixed": "6.6.145"
          }
        ]
      },
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "6.7.0"
          },
          {
            "fixed": "6.12.96"
          }
        ]
      },
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "6.13.0"
          },
          {
            "fixed": "6.18.39"
          }
        ]
      },
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "6.19.0"
          },
          {
            "fixed": "7.1.4"
          }
        ]
      }
    ],
    "package": {
      "name": "Kernel",
      "ecosystem": "Linux"
    },
    "database_specific": {
      "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-64455.json"
    }
  }
]
Related CVEs
CVE-2026-64455

Source reference: /id

Publisher severity

No explicit severity was provided.

Event
#50675 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement

Revision history

  1. CVE-2026-64455 · Revision 1Source updated