CVE-2026-93141

CVE-2026-93141

published September 17, 2026

CVSS
—
EPSS
0%
Percentile
11.9
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: r8a66597: avoid double free of ep0_req in probe error path

If usb_add_gadget_udc() fails, r8a66597_probe() jumps to err_add_udc

and frees ep0_req, then falls through to clean_up2 where ep0_req is

freed again when it is non-NULL.

Remove the redundant free from err_add_udc and keep the cleanup in

clean_up2 so the request is released exactly once.

Issue found using a prototype static analysis tool

and confirmed by code review.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00220 · 11.9th percentile
Published
2026-09-17T21:18Z
References (8)
EPSS history
Timeline
  • 19 SEP 03:55Z
    EPSS moved — → 0%
    epss
  • 17 SEP 16:11Z
    usb: gadget: r8a66597: avoid double free of ep0_req in probe error path
    cvelistv5