Strix
26.1K

CVE-2026-64345

UnknownEPSS 0.17%

Last modified

CVE-2026-64345 is a vulnerability of currently unknown severity. In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_printer: take kref only for successful open printer_open() returns -EBUSY when the character device is already open, but it increments dev->kref regardless of the return value. VFS does not call ->release() for a failed open, so every rejected second open permanently leaks one reference. Move kref_get() into the successful-open branch.. EPSS estimates a 0.17% chance of exploitation in the next 30 days.

Description

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_printer: take kref only for successful open printer_open() returns -EBUSY when the character device is already open, but it increments dev->kref regardless of the return value. VFS does not call ->release() for a failed open, so every rejected second open permanently leaks one reference. Move kref_get() into the successful-open branch.

Metrics

EPSS Probability
0.17%

6.9th percentile

Probability of exploitation in the next 30 days. Learn more

Affected Software

Source: CNA advisory (CVE.org). NVD analysis pending.

VendorProductVersions
LinuxLinux>= e8d5f92b8d30bb4ade76494490c3c065e12411b1, < 94ec20d97aa51547965a539f660a1fe79c6929a3; >= e8d5f92b8d30bb4ade76494490c3c065e12411b1, < 75c0ad13e136961328253742501b4efc3988a587; >= e8d5f92b8d30bb4ade76494490c3c065e12411b1, < bf20c94fa6aaff945f0ae3a23f3212cd299f28d9; >= e8d5f92b8d30bb4ade76494490c3c065e12411b1, < 8a5eba992c862b0c94411eecf9b7121e8636db38; >= e8d5f92b8d30bb4ade76494490c3c065e12411b1, < 7f1f24c367938c5537e2308bf9a965f051d14774; >= e8d5f92b8d30bb4ade76494490c3c065e12411b1, < 30adce93d5c4a5a1ec29d9249e3fdfcc391d406b; 25c95c6bd4dc50a3c20de0fa7f450ea02b2320fc; 4a47581cf010dc351d8069978080fdb000c0776d; d9fe88b2a38dc700bf5bd3a09c7cd11bbc248367; cedb0187b8ba929c3f76f28e6bc25804d65f8a54; e9e791f5c39ab30e374a3b1a9c25ca7ff24988f3; 34f026263889e2827e04acdc3a0eb9ecbd191ef0; 5f845e5d18d151230476cf90aa46449f69ba2ef1; >= 4.4.241, < 4.5; >= 4.9.241, < 4.10; >= 4.14.203, < 4.15; >= 4.19.154, < 4.20; >= 5.4.73, < 5.5; >= 5.8.17, < 5.9; >= 5.9.2, < 5.10
LinuxLinux5.10

References

Timeline

Published
Last Modified
Status
Awaiting Analysis

Frequently Asked Questions

What is CVE-2026-64345?
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_printer: take kref only for successful open printer_open() returns -EBUSY when the character device is already open, but it increments dev->kref regardless of the return value. VFS does not call ->release() for a failed open, so every rejected second open permanently leaks one reference. Move kref_get() into the successful-open branch.
How severe is CVE-2026-64345?
Severity scoring for CVE-2026-64345 is pending analysis. The EPSS model estimates a 0.17% probability of exploitation in the next 30 days.
How do I fix CVE-2026-64345?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2026

View all 2026CVEs →

Are you affected by CVE-2026-64345?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST