CVE-2026-64341: In the Linux kernel, the following vulnerability has been resolved: USB: iowarrior: fix use-after-free on disconnect race mutex_unlock() may access the mutex structure after rele

unknownCVE-2026-64341

In the Linux kernel, the following vulnerability has been resolved: USB: iowarrior: fix use-after-free on disconnect race mutex_unlock() may access the mutex structure after releasing the lock and therefore cannot be used to manage lifetime of objects directly (unlike spinlocks and refcounts). [1][2] Use a kref to release the driver data to avoid use-after-free in mutex_unlock() when release() races with disconnect(). [1] a51749ab34d9 ("locking/mutex: Document that mutex_unlock() is non-atomic") [2] 2b9d9e0a9ba0 ("locking/mutex: Clarify that mutex_unlock(), and most other sleeping locks, can still use the lock object after it's unlocked")

Details

Source: NVD Recent CVEs (US · database · site)
Severity: unknown
Published: 2026-07-25
Last updated: 2026-07-25
Exploitation: Not in CISA KEV at last sync

Original advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-64341

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2026-643410.17% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 6% of all scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-64341	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

unknownDSA-6405-1 linux - security updatedebian
highCVE-2026-64341: USB: iowarrior: fix use-after-free on disconnect racemsrc

Recent advisories for In the Linux

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

highUSN-8620-4: Linux kernel (Intel IoTG) vulnerabilitiesubuntu · 2026-07-31
highCVE-2026-18358: A flaw was found in gnome-remote-desktop as shipped in Red Hat Enterprise Linux. When the daem…nvd · 2026-07-31
medium[UPDATE] [medium] Linux Kernel: Multiple vulnerabilities allow denial of servicecert-bund · 2026-07-31
medium[UPDATE] [medium] Linux Kernel: Multiple vulnerabilities allow Denial of Servicecert-bund · 2026-07-31
medium[UPDATE] [medium] Linux Kernel: Multiple vulnerabilitiescert-bund · 2026-07-31
medium[UPDATE] [medium] Linux Kernel: Multiple vulnerabilities allow denial of servicecert-bund · 2026-07-31