CVE-2026-64345
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_printer: take kref only for successful open printer_open() returns -EBUSY when the character device is already open, but it increments dev->kref regardless of the return value. VFS does not call ->release() for a failed open, so every rejected second open permanently leaks one reference. Move kref_get() into the successful-open branch.
Affected versions
Linux kernel versions
4.4.241,
4.9.241,
4.14.203,
4.19.154,
5.4.73,
5.8.17,
5.9.2,
5.10
and later are affected. Fixed in
5.10.261,
6.6.145,
6.12.96,
6.18.39,
7.1.4,
7.2-rc3
and their respective stable series.
References
6 totalFrequently asked questions
-
What is CVE-2026-64345?
CVE-2026-64345 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 4.4.241 onward and has been patched in 5.10.261, 6.6.145, 6.12.96 and others. CVE-2026-64345 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
Is there a patch available for CVE-2026-64345?
Yes. CVE-2026-64345 has been patched. Fixed versions include 5.10.261, 6.6.145, 6.12.96 and others. If you are running Linux kernel 4.4.241 or later up to the fix versions, apply the relevant patch for your kernel branch.
-
Is CVE-2026-64345 actively exploited?
No. CVE-2026-64345 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.