---
id: CVE-2026-64341
title: 'USB: iowarrior: fix use-after-free on disconnect race'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  USB: iowarrior: fix use-after-free on disconnect race

  mutex_unlock() may access the mutex structure after releasing the lock
  and therefore cannot be used to manage lif…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 946b960d13c15f050a3b848987aaca79f6a459b7 <
    4e7d3c98fed73d3be84d3e146d8d9be0309e725b
  - >-
    Linux >= 946b960d13c15f050a3b848987aaca79f6a459b7 <
    3c0a7b29ebb391d5f50b115e86f842b709195b08
  - >-
    Linux >= 946b960d13c15f050a3b848987aaca79f6a459b7 <
    30ec3025b771511625375fb3fb959aea3b45fb0d
  - >-
    Linux >= 946b960d13c15f050a3b848987aaca79f6a459b7 <
    71590982700fdeb39a37a500c877228b0140978e
  - >-
    Linux >= 946b960d13c15f050a3b848987aaca79f6a459b7 <
    c602254ba4c10f60a73cd99d147874f86a3f485c
  - Linux 2.6.21
published: '2026-07-25'
updated: '2026-10-21'
sourceUpdated: '2026-10-21T12:43:16.721Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-64341'
references:
  - url: 'https://git.kernel.org/stable/c/4e7d3c98fed73d3be84d3e146d8d9be0309e725b'
  - url: 'https://git.kernel.org/stable/c/3c0a7b29ebb391d5f50b115e86f842b709195b08'
  - url: 'https://git.kernel.org/stable/c/30ec3025b771511625375fb3fb959aea3b45fb0d'
  - url: 'https://git.kernel.org/stable/c/71590982700fdeb39a37a500c877228b0140978e'
  - url: 'https://git.kernel.org/stable/c/c602254ba4c10f60a73cd99d147874f86a3f485c'
tags:
  - cve.org
epss: 0.00124
epssPercentile: 0.01917
ingestedAt: '2026-10-21T12:48:53.607Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

USB: iowarrior: fix use-after-free on disconnect race

mutex_unlock() may access the mutex structure after releasing the lock
and therefore cannot be used to manage lifetime of objects directly
(unlike spinlocks and refcounts). [1][2]

Use a kref to release the driver data to avoid use-after-free in
mutex_unlock() when release() races with disconnect().

[1] a51749ab34d9 ("locking/mutex: Document that mutex_unlock() is non-atomic")
[2] 2b9d9e0a9ba0 ("locking/mutex: Clarify that mutex_unlock(), and most
                   other sleeping locks, can still use the lock object
                   after it's unlocked")

## Affected

- `Linux >= 946b960d13c15f050a3b848987aaca79f6a459b7 < 4e7d3c98fed73d3be84d3e146d8d9be0309e725b`
- `Linux >= 946b960d13c15f050a3b848987aaca79f6a459b7 < 3c0a7b29ebb391d5f50b115e86f842b709195b08`
- `Linux >= 946b960d13c15f050a3b848987aaca79f6a459b7 < 30ec3025b771511625375fb3fb959aea3b45fb0d`
- `Linux >= 946b960d13c15f050a3b848987aaca79f6a459b7 < 71590982700fdeb39a37a500c877228b0140978e`
- `Linux >= 946b960d13c15f050a3b848987aaca79f6a459b7 < c602254ba4c10f60a73cd99d147874f86a3f485c`
- `Linux 2.6.21`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.