CVE-2026-64345

What it actually does

This is a Linux kernel denial-of-service flaw in the USB gadget printer function driver, f_printer. When the printer character device is already open, printer_open() correctly returns -EBUSY, but the vulnerable code still increments the device reference counter before failing. Because the VFS layer does not call the release path after a failed open, each rejected concurrent open permanently leaks a reference. Repeated failed open attempts can cause reference-count leakage and associated kernel resource retention, potentially preventing proper cleanup of the USB gadget printer function and degrading system stability over time.

Why it matters to the business

Systems that expose the Linux USB gadget printer function may be susceptible to local or physically adjacent denial-of-service conditions if an attacker or untrusted process can repeatedly trigger failed opens of the printer gadget device. The practical impact is most relevant to embedded Linux devices, appliances, development boards, kiosks, USB gadget implementations, and products using Linux USB device-mode printer functionality. The public exploitation likelihood appears low at this time, with low EPSS, no known CISA KEV listing, and no reported ransomware use, but affected device fleets may still experience instability, resource exhaustion, or service disruption if the vulnerable interface is accessible.

How an attack unfolds

An attacker first needs access to a system where the Linux USB gadget printer function is enabled and where they can attempt to open the associated printer gadget character device. The attacker opens the printer device once and keeps that file descriptor active, causing subsequent opens to fail with -EBUSY. They then repeatedly attempt additional opens. In the vulnerable kernel, each rejected open increments the device reference count even though the open failed and no matching release callback will occur. Over time, these leaked references accumulate and can prevent normal object cleanup or contribute to resource exhaustion and degraded kernel/device behavior. This is not known to provide code execution or privilege escalation by itself; the primary impact is denial of service or impaired device operation.

How to fix it

Apply a Linux kernel update that includes the f_printer fix moving kref_get() into the successful-open branch of printer_open(). Because no product-specific affected or fixed versions were provided, organizations should rely on their Linux distribution, embedded vendor, BSP, or kernel supplier advisories for exact patched package versions. For custom kernels, backport the upstream fix for usb: gadget: f_printer: take kref only for successful open. If immediate patching is not possible, disable the USB gadget printer function where it is not required, restrict local access to the associated gadget device node, remove unnecessary gadget configurations, and avoid exposing USB device-mode printer functionality on systems that do not need it.

How to confirm the fix worked

Confirm that the running kernel includes the f_printer patch by checking the vendor kernel changelog, distribution security advisory, package version, or source tree for the change that only takes the kref on successful open in printer_open(). On custom builds, inspect drivers/usb/gadget/function/f_printer.c and verify kref_get() is only executed after the open is accepted rather than before the -EBUSY failure path. Validate exposure by checking whether USB gadget support and the printer function are enabled in the kernel configuration and whether an active gadget configuration uses the printer function. After patching or mitigation, attempts to repeatedly open an already-busy printer gadget device should still fail with -EBUSY but should not cause persistent reference growth or cleanup failures when the gadget is removed or reconfigured.

Typical attack path

1. Identify a Linux system or embedded device using the USB gadget printer function, typically exposed through the f_printer gadget driver.
2. Obtain local execution, scripted access, or another capability that allows opening the printer gadget character device.
3. Open the printer gadget device and keep the descriptor open so the device remains busy.
4. Repeatedly attempt to open the same device from another process, thread, or loop, causing printer_open() to return -EBUSY.
5. Trigger the vulnerable reference-count path repeatedly, leaking one reference for each rejected open.
6. Continue until the affected gadget function cannot be cleaned up normally, resources are exhausted, or the device experiences degraded stability or denial of service.

How to detect it

Look for signs of repeated access attempts to the USB gadget printer character device while it is already in use. Relevant sources include auditd logs for open/openat/openat2 syscalls, eBPF or syscall telemetry, endpoint process telemetry, kernel logs, device-management logs, and embedded device application logs. Suspicious activity would include a process repeatedly opening the printer gadget device and receiving -EBUSY or "Device or resource busy" errors, especially in tight loops, from unexpected users, maintenance shells, test utilities, or newly introduced scripts. Kernel logs may also show USB gadget printer function cleanup, unbind, disconnect, or resource warnings after repeated failed opens, although the vulnerable reference leak may not always emit explicit log messages. For forensic review, identify processes that held the printer gadget device open for long periods and correlate them with bursts of failed open attempts by the same or different process. There are no known public threat actors or ransomware campaigns associated with this issue as of the provided data.

• Device or resource busy
• -EBUSY
• f_printer
• printer_open
• g_printer
• usb_f_printer
• drivers/usb/gadget/function/f_printer.c
• /dev/g_printer
• /dev/usb/lp0

What your security team should do

• Inventory Linux systems, embedded products, appliances, and development boards that enable USB gadget/device-mode functionality, specifically the f_printer printer gadget function.
• Prioritize patching for devices where untrusted local users, applications, containers, scripts, or physical operators can interact with the printer gadget character device.
• Update affected kernels through the relevant distribution, vendor, BSP, or device firmware channel; for custom kernels, backport the upstream f_printer reference-count fix.
• Disable the USB gadget printer function on systems where it is not operationally required.
• Restrict permissions on the printer gadget character device so only trusted service accounts or processes can open it.
• Monitor for repeated failed open attempts returning EBUSY against the printer gadget device, especially from unexpected users or processes.
• For embedded and appliance vendors, include this fix in the next maintenance firmware release even though current exploitation signals are low.