Double Free Vulnerability in Linux Kernel's net2280 USB Gadget

CVE-2026-64242

What is CVE-2026-64242?

A vulnerability exists in the Linux kernel's net2280 USB gadget that allows for a double free condition. When initializing the USB gadget, the system calls usb_initialize_gadget(), which sets up a release callback. If a probe error occurs, the net2280_remove() function is invoked to deconstruct the partially initialized device while simultaneously dropping a reference to the gadget. This can lead to an attempt to free the same object again due to calling kfree(dev), resulting in a double free scenario. The resolution involves removing the explicit kfree() call, allowing the gadget device's release callback to manage the final freeing of the object. This vulnerability was identified through static analysis methods.

References