GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-64329 (GCVE-0-2026-64329)

Vulnerability from cvelistv5 – Published: 2026-07-25 08:49 – Updated: 2026-08-17 04:53
VLAI
Title
usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove
Summary
In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove The threaded IRQ handler ccg_irq_handler() calls ucsi_notify_common(), which on a connector-change event calls ucsi_connector_change() and schedules connector work. In ucsi_ccg_remove(), ucsi_destroy() frees uc->ucsi (kfree) before free_irq() is called, so a handler invocation already in flight may access the freed object after ucsi_destroy(). CPU 0 (remove) | CPU 1 (threaded IRQ) ucsi_destroy(uc->ucsi) | ccg_irq_handler() kfree(ucsi) // FREE | ucsi_notify_common(uc->ucsi) // USE Move free_irq() before ucsi_destroy() in the remove path. It is kept after ucsi_unregister(): ucsi_unregister() cancels connector work whose handler issues GET_CONNECTOR_STATUS through ucsi_send_command_common(), which waits for a completion that is signalled from the IRQ handler, so the IRQ must stay active until that work has been cancelled. The probe error path already orders free_irq() before ucsi_destroy(). This bug was found by static analysis.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: e32fd989ac1c45f993fbe89ad0a89aa9ea6993d2 , < f1adeb1ff8bef1467d6961059810795d02bbad5d (git)
Affected: e32fd989ac1c45f993fbe89ad0a89aa9ea6993d2 , < 99381e762273a2410a3f0216000be32b013c0ea9 (git)
Affected: e32fd989ac1c45f993fbe89ad0a89aa9ea6993d2 , < 1a160076d3d0dcd4a98a4599ad96eec0790b099b (git)
Affected: e32fd989ac1c45f993fbe89ad0a89aa9ea6993d2 , < c32df11147822d22facee8fa30c2e8971d12f426 (git)
Affected: e32fd989ac1c45f993fbe89ad0a89aa9ea6993d2 , < 86c9ee928c4a370e323e432aaf8dca79c4ba7c85 (git)
Affected: e32fd989ac1c45f993fbe89ad0a89aa9ea6993d2 , < f5c772b76bbd95de8be51cf849c6098f6af6fcf9 (git)
Affected: e32fd989ac1c45f993fbe89ad0a89aa9ea6993d2 , < dbb500bad02146b388041877574829016591ddc8 (git)
Affected: e32fd989ac1c45f993fbe89ad0a89aa9ea6993d2 , < 1f0bdc2884b67de337215079bba166df0cdf4ac5 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.5
Unaffected: 0 , < 5.5 (semver)
Unaffected: 5.10.261 , ≤ 5.10.* (semver)
Unaffected: 5.15.212 , ≤ 5.15.* (semver)
Unaffected: 6.1.178 , ≤ 6.1.* (semver)
Unaffected: 6.6.145 , ≤ 6.6.* (semver)
Unaffected: 6.12.96 , ≤ 6.12.* (semver)
Unaffected: 6.18.39 , ≤ 6.18.* (semver)
Unaffected: 7.1.4 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/typec/ucsi/ucsi_ccg.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f1adeb1ff8bef1467d6961059810795d02bbad5d",
              "status": "affected",
              "version": "e32fd989ac1c45f993fbe89ad0a89aa9ea6993d2",
              "versionType": "git"
            },
            {
              "lessThan": "99381e762273a2410a3f0216000be32b013c0ea9",
              "status": "affected",
              "version": "e32fd989ac1c45f993fbe89ad0a89aa9ea6993d2",
              "versionType": "git"
            },
            {
              "lessThan": "1a160076d3d0dcd4a98a4599ad96eec0790b099b",
              "status": "affected",
              "version": "e32fd989ac1c45f993fbe89ad0a89aa9ea6993d2",
              "versionType": "git"
            },
            {
              "lessThan": "c32df11147822d22facee8fa30c2e8971d12f426",
              "status": "affected",
              "version": "e32fd989ac1c45f993fbe89ad0a89aa9ea6993d2",
              "versionType": "git"
            },
            {
              "lessThan": "86c9ee928c4a370e323e432aaf8dca79c4ba7c85",
              "status": "affected",
              "version": "e32fd989ac1c45f993fbe89ad0a89aa9ea6993d2",
              "versionType": "git"
            },
            {
              "lessThan": "f5c772b76bbd95de8be51cf849c6098f6af6fcf9",
              "status": "affected",
              "version": "e32fd989ac1c45f993fbe89ad0a89aa9ea6993d2",
              "versionType": "git"
            },
            {
              "lessThan": "dbb500bad02146b388041877574829016591ddc8",
              "status": "affected",
              "version": "e32fd989ac1c45f993fbe89ad0a89aa9ea6993d2",
              "versionType": "git"
            },
            {
              "lessThan": "1f0bdc2884b67de337215079bba166df0cdf4ac5",
              "status": "affected",
              "version": "e32fd989ac1c45f993fbe89ad0a89aa9ea6993d2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/typec/ucsi/ucsi_ccg.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.5"
            },
            {
              "lessThan": "5.5",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.96",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.261",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.96",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.39",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.4",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove\n\nThe threaded IRQ handler ccg_irq_handler() calls ucsi_notify_common(),\nwhich on a connector-change event calls ucsi_connector_change() and\nschedules connector work.  In ucsi_ccg_remove(), ucsi_destroy() frees\nuc-\u003eucsi (kfree) before free_irq() is called, so a handler invocation\nalready in flight may access the freed object after ucsi_destroy().\n\n  CPU 0 (remove)            | CPU 1 (threaded IRQ)\n    ucsi_destroy(uc-\u003eucsi)  |   ccg_irq_handler()\n      kfree(ucsi) // FREE   |     ucsi_notify_common(uc-\u003eucsi) // USE\n\nMove free_irq() before ucsi_destroy() in the remove path.  It is kept\nafter ucsi_unregister(): ucsi_unregister() cancels connector work whose\nhandler issues GET_CONNECTOR_STATUS through ucsi_send_command_common(),\nwhich waits for a completion that is signalled from the IRQ handler, so\nthe IRQ must stay active until that work has been cancelled.\n\nThe probe error path already orders free_irq() before ucsi_destroy().\n\nThis bug was found by static analysis."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:53:31.661Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f1adeb1ff8bef1467d6961059810795d02bbad5d"
        },
        {
          "url": "https://git.kernel.org/stable/c/99381e762273a2410a3f0216000be32b013c0ea9"
        },
        {
          "url": "https://git.kernel.org/stable/c/1a160076d3d0dcd4a98a4599ad96eec0790b099b"
        },
        {
          "url": "https://git.kernel.org/stable/c/c32df11147822d22facee8fa30c2e8971d12f426"
        },
        {
          "url": "https://git.kernel.org/stable/c/86c9ee928c4a370e323e432aaf8dca79c4ba7c85"
        },
        {
          "url": "https://git.kernel.org/stable/c/f5c772b76bbd95de8be51cf849c6098f6af6fcf9"
        },
        {
          "url": "https://git.kernel.org/stable/c/dbb500bad02146b388041877574829016591ddc8"
        },
        {
          "url": "https://git.kernel.org/stable/c/1f0bdc2884b67de337215079bba166df0cdf4ac5"
        }
      ],
      "title": "usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64329",
    "datePublished": "2026-07-25T08:49:57.098Z",
    "dateReserved": "2026-07-19T15:36:31.780Z",
    "dateUpdated": "2026-08-17T04:53:31.661Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-64329",
      "date": "2026-09-16",
      "epss": "0.00126",
      "percentile": "0.0259"
    },
    "microsoft_vex": {
      "current_release_date": "2026-07-27T14:40:54.000Z",
      "cve": "CVE-2026-64329",
      "id": "msrc_CVE-2026-64329",
      "initial_release_date": "2026-07-26T01:10:32.000Z",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-64329.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-64329\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-07-25T10:17:14.540\",\"lastModified\":\"2026-09-04T14:50:26.703\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nusb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove\\n\\nThe threaded IRQ handler ccg_irq_handler() calls ucsi_notify_common(),\\nwhich on a connector-change event calls ucsi_connector_change() and\\nschedules connector work.  In ucsi_ccg_remove(), ucsi_destroy() frees\\nuc-\u003eucsi (kfree) before free_irq() is called, so a handler invocation\\nalready in flight may access the freed object after ucsi_destroy().\\n\\n  CPU 0 (remove)            | CPU 1 (threaded IRQ)\\n    ucsi_destroy(uc-\u003eucsi)  |   ccg_irq_handler()\\n      kfree(ucsi) // FREE   |     ucsi_notify_common(uc-\u003eucsi) // USE\\n\\nMove free_irq() before ucsi_destroy() in the remove path.  It is kept\\nafter ucsi_unregister(): ucsi_unregister() cancels connector work whose\\nhandler issues GET_CONNECTOR_STATUS through ucsi_send_command_common(),\\nwhich waits for a completion that is signalled from the IRQ handler, so\\nthe IRQ must stay active until that work has been cancelled.\\n\\nThe probe error path already orders free_irq() before ucsi_destroy().\\n\\nThis bug was found by static analysis.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/usb/typec/ucsi/ucsi_ccg.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"e32fd989ac1c45f993fbe89ad0a89aa9ea6993d2\",\"lessThan\":\"f1adeb1ff8bef1467d6961059810795d02bbad5d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e32fd989ac1c45f993fbe89ad0a89aa9ea6993d2\",\"lessThan\":\"99381e762273a2410a3f0216000be32b013c0ea9\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e32fd989ac1c45f993fbe89ad0a89aa9ea6993d2\",\"lessThan\":\"1a160076d3d0dcd4a98a4599ad96eec0790b099b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e32fd989ac1c45f993fbe89ad0a89aa9ea6993d2\",\"lessThan\":\"c32df11147822d22facee8fa30c2e8971d12f426\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e32fd989ac1c45f993fbe89ad0a89aa9ea6993d2\",\"lessThan\":\"86c9ee928c4a370e323e432aaf8dca79c4ba7c85\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e32fd989ac1c45f993fbe89ad0a89aa9ea6993d2\",\"lessThan\":\"f5c772b76bbd95de8be51cf849c6098f6af6fcf9\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e32fd989ac1c45f993fbe89ad0a89aa9ea6993d2\",\"lessThan\":\"dbb500bad02146b388041877574829016591ddc8\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e32fd989ac1c45f993fbe89ad0a89aa9ea6993d2\",\"lessThan\":\"1f0bdc2884b67de337215079bba166df0cdf4ac5\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/usb/typec/ucsi/ucsi_ccg.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.5\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.5\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.261\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.212\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.178\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.145\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.96\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.39\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.4\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.261\",\"matchCriteriaId\":\"D5C5E8BC-1D5A-48B6-B6F0-F84166321AFC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.212\",\"matchCriteriaId\":\"8E99FB01-CD93-41AF-A653-3F450652B9A6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.178\",\"matchCriteriaId\":\"092233C7-F4E0-40C8-BD4D-A28FE50DFE20\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.145\",\"matchCriteriaId\":\"7046B092-F810-4440-ACE6-60218518EECE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.96\",\"matchCriteriaId\":\"38A8100E-2B1A-462F-AEE9-8901B870FEF2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.18.39\",\"matchCriteriaId\":\"914AE4BC-3D59-4C5A-9DB5-9CE327B429F7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.19\",\"versionEndExcluding\":\"7.1.4\",\"matchCriteriaId\":\"6228DDD6-4557-4AA3-9F43-AB995D471E42\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.2:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"5E8B9085-7ADB-4A05-89EF-12949B6A0509\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.2:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"1FC0D50D-9D58-4947-A197-A5A3FF07E7E3\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/1a160076d3d0dcd4a98a4599ad96eec0790b099b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/1f0bdc2884b67de337215079bba166df0cdf4ac5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/86c9ee928c4a370e323e432aaf8dca79c4ba7c85\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/99381e762273a2410a3f0216000be32b013c0ea9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c32df11147822d22facee8fa30c2e8971d12f426\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/dbb500bad02146b388041877574829016591ddc8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f1adeb1ff8bef1467d6961059810795d02bbad5d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f5c772b76bbd95de8be51cf849c6098f6af6fcf9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-04T16:54:55+00:00",
      "cve": "CVE-2026-64329",
      "id": "CVE-2026-64329",
      "initial_release_date": "2026-07-25T00:00:00+00:00",
      "product_status:known_affected": "184",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64329.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-15T01:51:51Z",
      "cve": "CVE-2026-64329",
      "id": "CVE-2026-64329",
      "initial_release_date": "2026-07-25T16:23:41Z",
      "product_status:first_fixed": "65",
      "product_status:known_affected": "394",
      "product_status:known_not_affected": "355",
      "product_status:recommended": "46",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-64329",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-64329.json",
      "version": "9"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.