Medium · published July 25, 2026
In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: f_printer: take kref only for successful open
printer_open() returns -EBUSY when the character device is already
open, but it increments dev->kref regardless of the return value. VFS
does not call ->release() for a failed open, so every rejected second
open permanently leaks one reference.
Move kref_get() into the successful-open branch.
| Product | Versions | Fixed in |
|---|---|---|
| linux/linux_kernel | ≥ 4.4.241, < 4.5 | 4.5 |
| linux/linux_kernel | ≥ 4.9.241, < 4.10 | 4.10 |
| linux/linux_kernel | ≥ 4.14.203, < 4.15 | 4.15 |
| linux/linux_kernel | ≥ 4.19.154, < 4.20 | 4.20 |
| linux/linux_kernel | ≥ 5.4.73, < 5.5 | 5.5 |
| linux/linux_kernel | ≥ 5.8.17, < 5.9 | 5.9 |
| linux/linux_kernel | ≥ 5.9.2, < 5.10.261 | 5.10.261 |
| linux/linux_kernel | ≥ 5.11, < 6.6.145 | 6.6.145 |
| linux/linux_kernel | ≥ 6.7, < 6.12.96 | 6.12.96 |
| linux/linux_kernel | ≥ 6.13, < 6.18.39 | 6.18.39 |
| linux/linux_kernel | ≥ 6.19, < 7.1.4 | 7.1.4 |
| linux/linux_kernel | all versions | — |
| linux/linux_kernel | all versions | — |