CVE-2026-64453 (GCVE-0-2026-64453)

Vulnerability from cvelistv5 – Published: 2026-07-25 08:51 – Updated: 2026-07-25 08:51
VLAI
Title
usb: misc: usbio: fix disconnect UAF in client teardown
Summary
In the Linux kernel, the following vulnerability has been resolved: usb: misc: usbio: fix disconnect UAF in client teardown usbio_disconnect() walks usbio->cli_list in reverse and uninitializes each auxiliary device. auxiliary_device_uninit() drops the device reference, and for an unbound child that can run usbio_auxdev_release() and free the containing struct usbio_client. list_for_each_entry_reverse() advances after the loop body by reading client->link.prev. If the current client is freed by auxiliary_device_uninit(), the iterator dereferences freed memory. Use list_for_each_entry_safe_reverse() so the previous client is cached before the body can drop the final reference. This preserves reverse teardown order while keeping the next iterator cursor independent of the current client's lifetime. Validation reproduced this kernel report: BUG: KASAN: slab-use-after-free in usbio_disconnect+0x12e/0x150 Call Trace: <TASK> dump_stack_lvl+0x66/0xa0 print_report+0xce/0x630 ? usbio_disconnect+0x12e/0x150 ? srso_alias_return_thunk+0x5/0xfbef5 ? __virt_addr_valid+0x188/0x320 ? usbio_disconnect+0x12e/0x150 kasan_report+0xe0/0x110 ? usbio_disconnect+0x12e/0x150 usbio_disconnect+0x12e/0x150 usb_unbind_interface+0xf3/0x400 really_probe+0x316/0x660 __driver_probe_device+0x106/0x240 driver_probe_device+0x4a/0x110 __device_attach_driver+0xf1/0x1a0 ? __pfx___device_attach_driver+0x10/0x10 bus_for_each_drv+0xf9/0x160 ? __pfx_bus_for_each_drv+0x10/0x10 ? srso_alias_return_thunk+0x5/0xfbef5 ? trace_hardirqs_on+0x18/0x130 ? srso_alias_return_thunk+0x5/0xfbef5 ? _raw_spin_unlock_irqrestore+0x44/0x60 __device_attach+0x133/0x2a0 ? __pfx___device_attach+0x10/0x10 ? srso_alias_return_thunk+0x5/0xfbef5 ? do_raw_spin_unlock+0x9a/0x100 ? srso_alias_return_thunk+0x5/0xfbef5 device_initial_probe+0x55/0x70 bus_probe_device+0x4a/0xd0 device_add+0x9b9/0xc10 ? __pfx_device_add+0x10/0x10 ? _raw_spin_unlock_irqrestore+0x44/0x60 ? srso_alias_return_thunk+0x5/0xfbef5 ? lockdep_hardirqs_on_prepare+0xea/0x1a0 ? srso_alias_return_thunk+0x5/0xfbef5 ? usb_enable_lpm+0x3c/0x260 usb_set_configuration+0xb64/0xf20 usb_generic_driver_probe+0x5f/0x90 usb_probe_device+0x71/0x1b0 really_probe+0x46b/0x660 __driver_probe_device+0x106/0x240 driver_probe_device+0x4a/0x110 __device_attach_driver+0xf1/0x1a0 ? __pfx___device_attach_driver+0x10/0x10 bus_for_each_drv+0xf9/0x160 ? __pfx_bus_for_each_drv+0x10/0x10 ? srso_alias_return_thunk+0x5/0xfbef5 ? trace_hardirqs_on+0x18/0x130 ? srso_alias_return_thunk+0x5/0xfbef5 ? _raw_spin_unlock_irqrestore+0x44/0x60 __device_attach+0x133/0x2a0 ? __pfx___device_attach+0x10/0x10 ? srso_alias_return_thunk+0x5/0xfbef5 ? do_raw_spin_unlock+0x9a/0x100 ? srso_alias_return_thunk+0x5/0xfbef5 device_initial_probe+0x55/0x70 bus_probe_device+0x4a/0xd0 device_add+0x9b9/0xc10 ? __pfx_device_add+0x10/0x10 ? srso_alias_return_thunk+0x5/0xfbef5 ? add_device_randomness+0xb7/0xf0 usb_new_device+0x492/0x870 hub_event+0x1b10/0x29c0 ? __pfx_hub_event+0x10/0x10 ? srso_alias_return_thunk+0x5/0xfbef5 ? lock_acquire+0x187/0x300 ? process_one_work+0x475/0xb90 ? srso_alias_return_thunk+0x5/0xfbef5 ? lock_release+0xc8/0x290 ? srso_alias_return_thunk+0x5/0xfbef5 process_one_work+0x4d7/0xb90 ? __pfx_process_one_work+0x10/0x10 ? srso_alias_return_thunk+0x5/0xfbef5 ? srso_alias_return_thunk+0x5/0xfbef5 ? __list_add_valid_or_report+0x37/0xf0 ? __pfx_hub_event+0x10/0x10 ? srso_alias_return_thunk+0x5/0xfbef5 worker_thread+0x2d8/0x570 ? __pfx_worker_thread+0x10/0x10 kthread+0x1ad/0x1f0 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x3c9/0x540 ? __pfx_ret_from_fork+0x10/0x10 ? srso_alias_return_thunk+0x5/0xfbef5 ? __switch_to+0x2e9/0x730 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 </TASK>
Severity
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 121a0f839dbb397af5fabb701cea3e9983223e50 , < c40090f8d19b415e2925b22be964b5d1f695666f (git)
Affected: 121a0f839dbb397af5fabb701cea3e9983223e50 , < 1947b6411460d68b54b13c536961933166937d05 (git)
Affected: 121a0f839dbb397af5fabb701cea3e9983223e50 , < 0bfeec21984fedd32987f4e4c0cde34b445af404 (git)
Create a notification for this product.
Linux Linux Affected: 6.18
Unaffected: 0 , < 6.18 (semver)
Unaffected: 6.18.39 , ≤ 6.18.* (semver)
Unaffected: 7.1.4 , ≤ 7.1.* (semver)
Unaffected: 7.2-rc3 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/misc/usbio.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "c40090f8d19b415e2925b22be964b5d1f695666f",
              "status": "affected",
              "version": "121a0f839dbb397af5fabb701cea3e9983223e50",
              "versionType": "git"
            },
            {
              "lessThan": "1947b6411460d68b54b13c536961933166937d05",
              "status": "affected",
              "version": "121a0f839dbb397af5fabb701cea3e9983223e50",
              "versionType": "git"
            },
            {
              "lessThan": "0bfeec21984fedd32987f4e4c0cde34b445af404",
              "status": "affected",
              "version": "121a0f839dbb397af5fabb701cea3e9983223e50",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/misc/usbio.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.18"
            },
            {
              "lessThan": "6.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2-rc3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.39",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.4",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2-rc3",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: misc: usbio: fix disconnect UAF in client teardown\n\nusbio_disconnect() walks usbio-\u003ecli_list in reverse and uninitializes each\nauxiliary device. auxiliary_device_uninit() drops the device reference, and\nfor an unbound child that can run usbio_auxdev_release() and free the\ncontaining struct usbio_client.\n\nlist_for_each_entry_reverse() advances after the loop body by reading\nclient-\u003elink.prev. If the current client is freed by\nauxiliary_device_uninit(), the iterator dereferences freed memory.\n\nUse list_for_each_entry_safe_reverse() so the previous client is\ncached before the body can drop the final reference. This preserves\nreverse teardown order while keeping the next iterator cursor independent\nof the current client\u0027s lifetime.\n\nValidation reproduced this kernel report:\nBUG: KASAN: slab-use-after-free in usbio_disconnect+0x12e/0x150\n\nCall Trace:\n \u003cTASK\u003e\n dump_stack_lvl+0x66/0xa0\n print_report+0xce/0x630\n ? usbio_disconnect+0x12e/0x150\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? __virt_addr_valid+0x188/0x320\n ? usbio_disconnect+0x12e/0x150\n kasan_report+0xe0/0x110\n ? usbio_disconnect+0x12e/0x150\n usbio_disconnect+0x12e/0x150\n usb_unbind_interface+0xf3/0x400\n really_probe+0x316/0x660\n __driver_probe_device+0x106/0x240\n driver_probe_device+0x4a/0x110\n __device_attach_driver+0xf1/0x1a0\n ? __pfx___device_attach_driver+0x10/0x10\n bus_for_each_drv+0xf9/0x160\n ? __pfx_bus_for_each_drv+0x10/0x10\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? trace_hardirqs_on+0x18/0x130\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? _raw_spin_unlock_irqrestore+0x44/0x60\n __device_attach+0x133/0x2a0\n ? __pfx___device_attach+0x10/0x10\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? do_raw_spin_unlock+0x9a/0x100\n ? srso_alias_return_thunk+0x5/0xfbef5\n device_initial_probe+0x55/0x70\n bus_probe_device+0x4a/0xd0\n device_add+0x9b9/0xc10\n ? __pfx_device_add+0x10/0x10\n ? _raw_spin_unlock_irqrestore+0x44/0x60\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? lockdep_hardirqs_on_prepare+0xea/0x1a0\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? usb_enable_lpm+0x3c/0x260\n usb_set_configuration+0xb64/0xf20\n usb_generic_driver_probe+0x5f/0x90\n usb_probe_device+0x71/0x1b0\n really_probe+0x46b/0x660\n __driver_probe_device+0x106/0x240\n driver_probe_device+0x4a/0x110\n __device_attach_driver+0xf1/0x1a0\n ? __pfx___device_attach_driver+0x10/0x10\n bus_for_each_drv+0xf9/0x160\n ? __pfx_bus_for_each_drv+0x10/0x10\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? trace_hardirqs_on+0x18/0x130\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? _raw_spin_unlock_irqrestore+0x44/0x60\n __device_attach+0x133/0x2a0\n ? __pfx___device_attach+0x10/0x10\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? do_raw_spin_unlock+0x9a/0x100\n ? srso_alias_return_thunk+0x5/0xfbef5\n device_initial_probe+0x55/0x70\n bus_probe_device+0x4a/0xd0\n device_add+0x9b9/0xc10\n ? __pfx_device_add+0x10/0x10\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? add_device_randomness+0xb7/0xf0\n usb_new_device+0x492/0x870\n hub_event+0x1b10/0x29c0\n ? __pfx_hub_event+0x10/0x10\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? lock_acquire+0x187/0x300\n ? process_one_work+0x475/0xb90\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? lock_release+0xc8/0x290\n ? srso_alias_return_thunk+0x5/0xfbef5\n process_one_work+0x4d7/0xb90\n ? __pfx_process_one_work+0x10/0x10\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? __list_add_valid_or_report+0x37/0xf0\n ? __pfx_hub_event+0x10/0x10\n ? srso_alias_return_thunk+0x5/0xfbef5\n worker_thread+0x2d8/0x570\n ? __pfx_worker_thread+0x10/0x10\n kthread+0x1ad/0x1f0\n ? __pfx_kthread+0x10/0x10\n ret_from_fork+0x3c9/0x540\n ? __pfx_ret_from_fork+0x10/0x10\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? __switch_to+0x2e9/0x730\n ? __pfx_kthread+0x10/0x10\n ret_from_fork_asm+0x1a/0x30\n \u003c/TASK\u003e"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-25T08:51:22.478Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/c40090f8d19b415e2925b22be964b5d1f695666f"
        },
        {
          "url": "https://git.kernel.org/stable/c/1947b6411460d68b54b13c536961933166937d05"
        },
        {
          "url": "https://git.kernel.org/stable/c/0bfeec21984fedd32987f4e4c0cde34b445af404"
        }
      ],
      "title": "usb: misc: usbio: fix disconnect UAF in client teardown",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64453",
    "datePublished": "2026-07-25T08:51:22.478Z",
    "dateReserved": "2026-07-19T15:36:31.789Z",
    "dateUpdated": "2026-07-25T08:51:22.478Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-64453",
      "date": "2026-08-03",
      "epss": "0.00173",
      "percentile": "0.07016"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-64453\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-07-25T10:17:30.273\",\"lastModified\":\"2026-07-25T10:17:30.273\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nusb: misc: usbio: fix disconnect UAF in client teardown\\n\\nusbio_disconnect() walks usbio-\u003ecli_list in reverse and uninitializes each\\nauxiliary device. auxiliary_device_uninit() drops the device reference, and\\nfor an unbound child that can run usbio_auxdev_release() and free the\\ncontaining struct usbio_client.\\n\\nlist_for_each_entry_reverse() advances after the loop body by reading\\nclient-\u003elink.prev. If the current client is freed by\\nauxiliary_device_uninit(), the iterator dereferences freed memory.\\n\\nUse list_for_each_entry_safe_reverse() so the previous client is\\ncached before the body can drop the final reference. This preserves\\nreverse teardown order while keeping the next iterator cursor independent\\nof the current client\u0027s lifetime.\\n\\nValidation reproduced this kernel report:\\nBUG: KASAN: slab-use-after-free in usbio_disconnect+0x12e/0x150\\n\\nCall Trace:\\n \u003cTASK\u003e\\n dump_stack_lvl+0x66/0xa0\\n print_report+0xce/0x630\\n ? usbio_disconnect+0x12e/0x150\\n ? srso_alias_return_thunk+0x5/0xfbef5\\n ? __virt_addr_valid+0x188/0x320\\n ? usbio_disconnect+0x12e/0x150\\n kasan_report+0xe0/0x110\\n ? usbio_disconnect+0x12e/0x150\\n usbio_disconnect+0x12e/0x150\\n usb_unbind_interface+0xf3/0x400\\n really_probe+0x316/0x660\\n __driver_probe_device+0x106/0x240\\n driver_probe_device+0x4a/0x110\\n __device_attach_driver+0xf1/0x1a0\\n ? __pfx___device_attach_driver+0x10/0x10\\n bus_for_each_drv+0xf9/0x160\\n ? __pfx_bus_for_each_drv+0x10/0x10\\n ? srso_alias_return_thunk+0x5/0xfbef5\\n ? trace_hardirqs_on+0x18/0x130\\n ? srso_alias_return_thunk+0x5/0xfbef5\\n ? _raw_spin_unlock_irqrestore+0x44/0x60\\n __device_attach+0x133/0x2a0\\n ? __pfx___device_attach+0x10/0x10\\n ? srso_alias_return_thunk+0x5/0xfbef5\\n ? do_raw_spin_unlock+0x9a/0x100\\n ? srso_alias_return_thunk+0x5/0xfbef5\\n device_initial_probe+0x55/0x70\\n bus_probe_device+0x4a/0xd0\\n device_add+0x9b9/0xc10\\n ? __pfx_device_add+0x10/0x10\\n ? _raw_spin_unlock_irqrestore+0x44/0x60\\n ? srso_alias_return_thunk+0x5/0xfbef5\\n ? lockdep_hardirqs_on_prepare+0xea/0x1a0\\n ? srso_alias_return_thunk+0x5/0xfbef5\\n ? usb_enable_lpm+0x3c/0x260\\n usb_set_configuration+0xb64/0xf20\\n usb_generic_driver_probe+0x5f/0x90\\n usb_probe_device+0x71/0x1b0\\n really_probe+0x46b/0x660\\n __driver_probe_device+0x106/0x240\\n driver_probe_device+0x4a/0x110\\n __device_attach_driver+0xf1/0x1a0\\n ? __pfx___device_attach_driver+0x10/0x10\\n bus_for_each_drv+0xf9/0x160\\n ? __pfx_bus_for_each_drv+0x10/0x10\\n ? srso_alias_return_thunk+0x5/0xfbef5\\n ? trace_hardirqs_on+0x18/0x130\\n ? srso_alias_return_thunk+0x5/0xfbef5\\n ? _raw_spin_unlock_irqrestore+0x44/0x60\\n __device_attach+0x133/0x2a0\\n ? __pfx___device_attach+0x10/0x10\\n ? srso_alias_return_thunk+0x5/0xfbef5\\n ? do_raw_spin_unlock+0x9a/0x100\\n ? srso_alias_return_thunk+0x5/0xfbef5\\n device_initial_probe+0x55/0x70\\n bus_probe_device+0x4a/0xd0\\n device_add+0x9b9/0xc10\\n ? __pfx_device_add+0x10/0x10\\n ? srso_alias_return_thunk+0x5/0xfbef5\\n ? add_device_randomness+0xb7/0xf0\\n usb_new_device+0x492/0x870\\n hub_event+0x1b10/0x29c0\\n ? __pfx_hub_event+0x10/0x10\\n ? srso_alias_return_thunk+0x5/0xfbef5\\n ? lock_acquire+0x187/0x300\\n ? process_one_work+0x475/0xb90\\n ? srso_alias_return_thunk+0x5/0xfbef5\\n ? lock_release+0xc8/0x290\\n ? srso_alias_return_thunk+0x5/0xfbef5\\n process_one_work+0x4d7/0xb90\\n ? __pfx_process_one_work+0x10/0x10\\n ? srso_alias_return_thunk+0x5/0xfbef5\\n ? srso_alias_return_thunk+0x5/0xfbef5\\n ? __list_add_valid_or_report+0x37/0xf0\\n ? __pfx_hub_event+0x10/0x10\\n ? srso_alias_return_thunk+0x5/0xfbef5\\n worker_thread+0x2d8/0x570\\n ? __pfx_worker_thread+0x10/0x10\\n kthread+0x1ad/0x1f0\\n ? __pfx_kthread+0x10/0x10\\n ret_from_fork+0x3c9/0x540\\n ? __pfx_ret_from_fork+0x10/0x10\\n ? srso_alias_return_thunk+0x5/0xfbef5\\n ? __switch_to+0x2e9/0x730\\n ? __pfx_kthread+0x10/0x10\\n ret_from_fork_asm+0x1a/0x30\\n \u003c/TASK\u003e\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/usb/misc/usbio.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"121a0f839dbb397af5fabb701cea3e9983223e50\",\"lessThan\":\"c40090f8d19b415e2925b22be964b5d1f695666f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"121a0f839dbb397af5fabb701cea3e9983223e50\",\"lessThan\":\"1947b6411460d68b54b13c536961933166937d05\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"121a0f839dbb397af5fabb701cea3e9983223e50\",\"lessThan\":\"0bfeec21984fedd32987f4e4c0cde34b445af404\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/usb/misc/usbio.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.18\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.18\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.39\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.4\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2-rc3\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0bfeec21984fedd32987f4e4c0cde34b445af404\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/1947b6411460d68b54b13c536961933166937d05\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/c40090f8d19b415e2925b22be964b5d1f695666f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-30T04:23:01+00:00",
      "cve": "CVE-2026-64453",
      "id": "CVE-2026-64453",
      "initial_release_date": "2026-07-25T00:00:00+00:00",
      "product_status:known_affected": "76",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: usb: misc: usbio: fix disconnect UAF in client teardown",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64453.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "not set",
      "current_release_date": "2026-07-25T15:59:02Z",
      "cve": "CVE-2026-64453",
      "id": "CVE-2026-64453",
      "initial_release_date": "2026-07-25T15:59:02Z",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-64453",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-64453.json",
      "version": "2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.