Most recent entries from all

fkie_cve-2026-93141

2026-09-30T22:14:09.775981+00:00

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: r8a66597: avoid double free of ep0_req in probe error path

If usb_add_gadget_udc() fails, r8a66597_probe() jumps to err_add_udc and frees ep0_req, then falls through to clean_up2 where ep0_req is freed again when it is non-NULL.

Remove the redundant free from err_add_udc and keep the cleanup in clean_up2 so the request is released exactly once.

Issue found using a prototype static analysis tool and confirmed by code review.

GHSA-w375-mqgw-7grh

2026-09-30T22:14:09.776050+00:00

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: r8a66597: avoid double free of ep0_req in probe error path

If usb_add_gadget_udc() fails, r8a66597_probe() jumps to err_add_udc and frees ep0_req, then falls through to clean_up2 where ep0_req is freed again when it is non-NULL.

Remove the redundant free from err_add_udc and keep the cleanup in clean_up2 so the request is released exactly once.

Issue found using a prototype static analysis tool and confirmed by code review.

msrc_CVE-2026-93141 — usb: gadget: r8a66597: avoid double free of ep0_req in probe error path

2026-09-30T22:14:09.776074+00:00

msrc_CVE-2026-93141

openSUSE-SU-2026:11893-1 — kernel-devel-7.2.8-1.1 on GA media

2026-09-30T22:14:09.776092+00:00

kernel-devel-7.2.8-1.1 on GA media

UBUNTU-CVE-2026-93141

2026-09-30T22:14:09.776210+00:00

Affected: Ubuntu:Pro:14.04:LTS: linux-aws, Ubuntu:Pro:14.04:LTS: linux-azure, Ubuntu:Pro:14.04:LTS: linux-lts-xenial, Ubuntu:Pro:16.04:LTS: linux, Ubuntu:Pro:16.04:LTS: linux-aws, Ubuntu:Pro:16.04:LTS: linux-aws-hwe, Ubuntu:Pro:16.04:LTS: linux-azure, Ubuntu:Pro:16.04:LTS: linux-gcp, Ubuntu:Pro:16.04:LTS: linux-hwe, Ubuntu:16.04:LTS: linux-hwe-edge and 245 more

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: r8a66597: avoid double free of ep0_req in probe error path If usb_add_gadget_udc() fails, r8a66597_probe() jumps to err_add_udc and frees ep0_req, then falls through to clean_up2 where ep0_req is freed again when it is non-NULL. Remove the redundant free from err_add_udc and keep the cleanup in clean_up2 so the request is released exactly once. Issue found using a prototype static analysis tool and confirmed by code review.