CVE-2026-64342: USB: iowarrior: fix use-after-free on disconnect

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

USB: iowarrior: fix use-after-free on disconnect

Submitted write URBs are not stopped on close() and therefore need to be
stopped unconditionally on disconnect() to avoid use-after-free in the
completion handler.

The Linux kernel CVE team has assigned CVE-2026-64342 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 2.6.21 with commit 946b960d13c15f050a3b848987aaca79f6a459b7 and fixed in 5.10.261 with commit d058d377291567b72aea33b017215cbfb383b0ad
	Issue introduced in 2.6.21 with commit 946b960d13c15f050a3b848987aaca79f6a459b7 and fixed in 5.15.212 with commit a7bbe946ca3a6eeb6f364d5e84b05e02c7c0d595
	Issue introduced in 2.6.21 with commit 946b960d13c15f050a3b848987aaca79f6a459b7 and fixed in 6.1.178 with commit 97ad9337127be04ca0b027c2b01e69302353f404
	Issue introduced in 2.6.21 with commit 946b960d13c15f050a3b848987aaca79f6a459b7 and fixed in 6.6.145 with commit 164398601a7f160bc3df1efa454f983302cef03f
	Issue introduced in 2.6.21 with commit 946b960d13c15f050a3b848987aaca79f6a459b7 and fixed in 6.12.96 with commit f328b0e9a0dbd162f5db1b83026b689f2fea2241
	Issue introduced in 2.6.21 with commit 946b960d13c15f050a3b848987aaca79f6a459b7 and fixed in 6.18.39 with commit b748f97aff339e7f08dca9cf38a05b980fb66fea
	Issue introduced in 2.6.21 with commit 946b960d13c15f050a3b848987aaca79f6a459b7 and fixed in 7.1.4 with commit e4596816984efc537e7c04c1af0c639394f967f7
	Issue introduced in 2.6.21 with commit 946b960d13c15f050a3b848987aaca79f6a459b7 and fixed in 7.2-rc3 with commit bc0e4f16c44e50daa0b1ea729934baa3b4815dee

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-64342
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/usb/misc/iowarrior.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/d058d377291567b72aea33b017215cbfb383b0ad
	https://git.kernel.org/stable/c/a7bbe946ca3a6eeb6f364d5e84b05e02c7c0d595
	https://git.kernel.org/stable/c/97ad9337127be04ca0b027c2b01e69302353f404
	https://git.kernel.org/stable/c/164398601a7f160bc3df1efa454f983302cef03f
	https://git.kernel.org/stable/c/f328b0e9a0dbd162f5db1b83026b689f2fea2241
	https://git.kernel.org/stable/c/b748f97aff339e7f08dca9cf38a05b980fb66fea
	https://git.kernel.org/stable/c/e4596816984efc537e7c04c1af0c639394f967f7
	https://git.kernel.org/stable/c/bc0e4f16c44e50daa0b1ea729934baa3b4815dee