Cloudanix VulnDB

CVE-2026-93141

None

CVSS

—

EPSS

0.2%

Published

Sep 17, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A coding mistake in a USB driver inside the Linux kernel can let an attacker who already has access to the machine corrupt memory and potentially take over the system.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
High
Impact
Privilege Gain
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Double-free of the ep0_req allocation in the r8a66597 USB gadget driver's probe error path, where a failure in usb_add_gadget_udc leads to the same kernel memory object being released twice.

Why it matters to the business

Kernel memory corruption on systems using the affected USB controller can cause crashes, denial of service, or local privilege escalation, requiring urgent patching of Linux kernels that include this driver.

How an attack unfolds

An attacker with local access triggers the USB gadget probe sequence so that usb_add_gadget_udc fails, causing the error path to free ep0_req and then fall through to the common cleanup routine that frees the same object again, resulting in memory corruption that can be turned into arbitrary kernel writes or crashes.

How to fix it

Apply the upstream kernel patch that removes the redundant kfree in the err_add_udc label and ensure only the single free in clean_up2 executes; rebuild and deploy the fixed kernel.

How to confirm the fix worked

Inspect the r8a66597_probe function in the kernel source to confirm the err_add_udc label no longer contains a kfree(ep0_req) call and that clean_up2 remains the sole release point; boot-test the updated kernel with the gadget driver loaded.

Typical attack path

  1. Obtain local execution on a system exposing the r8a66597 USB gadget
  2. Force or wait for gadget driver probe to run
  3. Arrange for usb_add_gadget_udc to return an error
  4. Trigger the double-free of ep0_req during error cleanup
  5. Leverage resulting memory state for privilege escalation or denial of service

How to detect it

Review kernel logs for oops or panic messages referencing double-free or slab corruption in the usb/gadget/r8a66597 path; examine audit logs for unusual gadget probe failures immediately preceding crashes.

What your security team should do

  • Prioritize kernel updates for any distribution shipping the r8a66597 gadget driver
  • Monitor vendor advisories for backported fixes in LTS kernels
  • Restrict local access on systems that expose this USB gadget until patched

The record

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: r8a66597: avoid double free of ep0_req in probe error path If usb_add_gadget_udc() fails, r8a66597_probe() jumps to err_add_udc and frees ep0_req, then falls through to clean_up2 where ep0_req is freed again when it is non-NULL. Remove the redundant free from err_add_udc and keep the cleanup in clean_up2 so the request is released exactly once. Issue found using a prototype static analysis tool and confirmed by code review.

Affected packages

Ecosystem Package Introduced Fixed