wifi: rt2x00usb: fix devres lifetime (Linux Linux)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.11 % · percentile 1 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- Linux
- NVD status
- Analyzed
Description
In the Linux kernel, the following vulnerability has been resolved: wifi: rt2x00usb: fix devres lifetime USB drivers bind to USB interfaces and any device managed resources should have their lifetime tied to the interface rather than parent USB device. This avoids issues like memory leaks when drivers are unbound without their devices being physically disconnected (e.g. on probe deferral or configuration changes). Fix the USB anchor lifetime so that it is released on driver unbind.
Weaknesses (CWE)
- CWE-401 — Missing Release of Memory after Effective Lifetime
References
- https://git.kernel.org/stable/c/64a457f6afbf15f984d95201a9a1e71eed3f9dd1
- https://git.kernel.org/stable/c/65518a6965d527c53013947031f26754f6a4f6af
- https://git.kernel.org/stable/c/15b233e33b35b927bd8d0044c15325564ea1ba24
- https://git.kernel.org/stable/c/1de5c76bf40e9cdeebf54662f63011fb10fa452f
- https://git.kernel.org/stable/c/b245db719bc7e57abf48bd5701662b270c3880f7
- https://git.kernel.org/stable/c/e360d15fcb1e819eef49e3d4434d8050542eed16
- https://git.kernel.org/stable/c/c99f198841b41735796e2ddfcd573783fb552eb9
- https://git.kernel.org/stable/c/25369b22223d1c56e42a0cd4ac9137349d5a898e
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2026-25565
- GCVE · GCVE-0-2026-31672
CERT-FR advisories
- CERTFR-2026-AVI-1229 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1093 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1066 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1064 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0985 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0954 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0927 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0926 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0696 — Multiples vulnérabilités dans le noyau Linux de Debian LTS · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0548 — Multiples vulnérabilités dans le noyau Linux de Debian · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0547 — Multiples vulnérabilités dans le noyau Linux de Debian LTS · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0526 — Multiples vulnérabilités dans les produits Microsoft · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 4.7.1 < 5.10.253cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.11 < 5.15.203cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.16 < 6.1.169cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.2 < 6.6.135cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.7 < 6.12.82cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.13 < 6.18.23cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.19 < 6.19.13cpe:2.3:o:linux:linux_kernel:4.7:-:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*
Affected products
| Product | Versions |
|---|---|
| Linux · Linux | affected 8b4c0009313f3d42e2540e3e1f776097dd0db73d < 64a457f6afbf15f984d95201a9a1e71eed3f9dd1 ; affected 8b4c0009313f3d42e2540e3e1f776097dd0db73d < 65518a6965d527c53013947031f26754f6a4f6af ; affected 8b4c0009313f3d42e2540e3e1f776097dd0db73d < 15b233e33b35b927bd8d0044c15325564ea1ba24 ; affected 8b4c0009313f3d42e2540e3e1f776097dd0db73d < 1de5c76bf40e9cdeebf54662f63011fb10fa452f ; affected 8b4c0009313f3d42e2540e3e1f776097dd0db73d < b245db719bc7e57abf48bd5701662b270c3880f7 ; affected 8b4c0009313f3d42e2540e3e1f776097dd0db73d < e360d15fcb1e819eef49e3d4434d8050542eed16 |
| Linux · Linux | affected 4.7 ; unaffected 0 < 4.7 ; unaffected 5.10.253 ≤ 5.10.* ; unaffected 5.15.203 ≤ 5.15.* ; unaffected 6.1.169 ≤ 6.1.* ; unaffected 6.6.135 ≤ 6.6.* |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |