CVE-2026-64455

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> USB: chaoskey: Fix slab-use-after-free in chaoskey_release()<br /> <br /> The chaoskey driver has a use-after-free bug in its release routine.<br /> If the user closes the device file after the USB device has been<br /> unplugged, a debugging log statement will try to access the<br /> usb_interface structure after it has been deallocated:<br /> <br /> BUG: KASAN: slab-use-after-free in dev_driver_string (drivers/base/core.c:2406)<br /> Read of size 8 at addr ffff888168e8a0b8 by task chaoskey_raw_re/10106<br /> <br /> Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014<br /> Call Trace:<br /> <br /> dump_stack_lvl (lib/dump_stack.c:94 lib/dump_stack.c:120)<br /> print_report (mm/kasan/report.c:378 mm/kasan/report.c:482)<br /> kasan_report (mm/kasan/report.c:595)<br /> dev_driver_string (drivers/base/core.c:2406)<br /> __dynamic_dev_dbg (lib/dynamic_debug.c:906)<br /> chaoskey_release (drivers/usb/misc/chaoskey.c:323)<br /> __fput (fs/file_table.c:510)<br /> fput_close_sync (fs/file_table.c:615)<br /> __x64_sys_close (fs/open.c:1507 fs/open.c:1492 fs/open.c:1492)<br /> do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94)<br /> entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)<br /> <br /> The driver&amp;#39;s last reference to the interface structure is dropped in<br /> the chaoskey_free() routine, so the code must not use the interface --<br /> even in a debugging statement -- after that routine returns.<br /> (Exception: If we know that another reference is held by someone else,<br /> such as the device core while the disconnect routine runs, there&amp;#39;s no<br /> problem. Thanks to Johan Hovold for pointing this out.)<br /> <br /> Since the bad access is part of an unimportant debugging statement,<br /> we can fix the problem simply by removing the whole statement.