Medium 5.5Published Jul 25, 2026

CVE-2026-64338USB: misc: uss720: unregister parport on probe failure

Updated under an hour ago (Oct 26, 2026, 6:30 PM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: USB: misc: uss720: unregister parport on probe failure uss720_probe() registers a parport before reading the 1284 register used to detect unsupported Belkin F5U002 adapters. If get_1284_register() fails, the error path drops the driver private data and the USB device reference, but leaves the parport device registered. Leaving the port registered is more than a private allocation leak: parport_register_port() has already reserved a parport number and registered the parport bus device, while pp->private_data still points at the private data that the common error path is about to release. Undo the pre-announce registration in the get_1284_register() failure branch before jumping to the common private-data cleanup path. Clear priv->pp first, matching the disconnect path and avoiding a stale pointer in the private data. This issue was identified during our ongoing static-analysis research while reviewing kernel code.

CVSS: 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Analyzed
Record last updated: Aug 17, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	04736c1bc32197f7d859e01a96ae80a16659931d builds before 6bbb98bec71b577fda4f4b48f7aea5874b04a576; from 4eaf2331a77996bbbaf2b824d452ac8ebda7e6e7 before 93563243377f8e9b46cc94d9c4f06533dd31b141; from 8fc246a8a456679993df565d3c9e3da28030ee43 before 1712fd71a5aaf81e47c747f180535fa963ad7830; 10132ccf99f49b43aeb7470df50d72344a601ad6 builds before 0b3073f40cc9f95d5ff0037eb0a06f5c1725a7ea; 3295f1b866bfbcabd625511968e8a5c541f9ab32 builds before 5e62d7857fd51b908b8371062ee839739a086bbe; 3295f1b866bfbcabd625511968e8a5c541f9ab32 builds before 729b68a5bad71220ae0914c8bdab9488ad5be6c8; 3295f1b866bfbcabd625511968e8a5c541f9ab32 builds before 48dd0b2ec9f2e97c486eb68cd0a64b25c1c3df3e; from 3295f1b866bfbcabd625511968e8a5c541f9ab32 before b4ecbdc4f8830f5586c4a5cfc384c00f20f8f8b3; and 10 more ranges	CNA record
linux linux_kernel linux:linux_kernel	from 4.19.317 before 4.20; from 5.4.279 before 5.5; from 5.10.221 before 5.10.261; from 5.15.162 before 5.15.212; from 6.1.96 before 6.1.178; from 6.6.36 before 6.6.145; from 6.9.7 before 6.12.96; from 6.13 before 6.18.39; and 3 more ranges	NVD

References

References

https://git.kernel.org/stable/c/6bbb98bec71b577fda4f4b48f7aea5874b04a576	patch
https://git.kernel.org/stable/c/93563243377f8e9b46cc94d9c4f06533dd31b141	patch
https://git.kernel.org/stable/c/1712fd71a5aaf81e47c747f180535fa963ad7830	patch
https://git.kernel.org/stable/c/0b3073f40cc9f95d5ff0037eb0a06f5c1725a7ea	patch
https://git.kernel.org/stable/c/5e62d7857fd51b908b8371062ee839739a086bbe	patch
https://git.kernel.org/stable/c/729b68a5bad71220ae0914c8bdab9488ad5be6c8	patch
https://git.kernel.org/stable/c/48dd0b2ec9f2e97c486eb68cd0a64b25c1c3df3e	patch
https://git.kernel.org/stable/c/b4ecbdc4f8830f5586c4a5cfc384c00f20f8f8b3	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.