{"id":"CVE-2026-93141","revision":"d6fc95c276bd4555a6f5771c60f4e42b","records":[{"revision":"d6fc95c276bd4555a6f5771c60f4e42b","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-93141","aliases":[],"title":"usb: gadget: r8a66597: avoid double free of ep0_req in probe error path","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: r8a66597: avoid double free of ep0_req in probe error path\n\nIf usb_add_gadget_udc() fails, r8a66597_probe() jumps to err_add_udc\nand frees ep0_req, then falls through to clean_up2 where ep0_req is\nfreed again when it is non-NULL.\n\nRemove the redundant free from err_add_udc and keep the cleanup in\nclean_up2 so the request is released exactly once.\n\nIssue found using a prototype static analysis tool\nand confirmed by code review.","state":0,"publishedAt":"2026-09-17T16:11:40.761+00:00","modifiedAt":"2026-10-19T09:06:13.931+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/usb/gadget/udc/r8a66597-udc.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"776976a67ae25d18be42794fd783a50757402cbe\",\n                            \"lessThan\": \"c9e93290ffe7db22a8131a5f5fd026335090fbbe\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"776976a67ae25d18be42794fd783a50757402cbe\",\n                            \"lessThan\": \"7721cf32efa428bd9649f4a9b89fc85601df87de\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"776976a67ae25d18be42794fd783a50757402cbe\",\n                            \"lessThan\": \"f9c43246128a2dd0f2bbad71decf153910ce3606\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"776976a67ae25d18be42794fd783a50757402cbe\",\n                            \"lessThan\": \"150d3f3c461345b6c9ae784912cf1e49c8e5ff6b\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"776976a67ae25d18be42794fd783a50757402cbe\",\n                            \"lessThan\": \"b2e68583c7c51eea2aafb8f1793e0d285c56ac82\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"776976a67ae25d18be42794fd783a50757402cbe\",\n                            \"lessThan\": \"6648c470918371766f6d368113dd2a4faebac93f\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"776976a67ae25d18be42794fd783a50757402cbe\",\n                            \"lessThan\": \"6be64cca6527f7fc99b05abf54f22db91bbc116f\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"776976a67ae25d18be42794fd783a50757402cbe\",\n                            \"lessThan\": \"41d541e3718db01668a4cd29815ee4b3b55f76d2\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/usb/gadget/udc/r8a66597-udc.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"3.17\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"3.17\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.10.270\",\n                            \"lessThanOrEqual\": \"5.10.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.221\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.188\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.157\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.110\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.52\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.6\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/c9e93290ffe7db22a8131a5f5fd026335090fbbe","https://git.kernel.org/stable/c/7721cf32efa428bd9649f4a9b89fc85601df87de","https://git.kernel.org/stable/c/f9c43246128a2dd0f2bbad71decf153910ce3606","https://git.kernel.org/stable/c/150d3f3c461345b6c9ae784912cf1e49c8e5ff6b","https://git.kernel.org/stable/c/b2e68583c7c51eea2aafb8f1793e0d285c56ac82","https://git.kernel.org/stable/c/6648c470918371766f6d368113dd2a4faebac93f","https://git.kernel.org/stable/c/6be64cca6527f7fc99b05abf54f22db91bbc116f","https://git.kernel.org/stable/c/41d541e3718db01668a4cd29815ee4b3b55f76d2"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-93141","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-93141","identifiers":["CVE-2026-93141"]},"retained":false,"historicalAffected":[]}],"coverage":[]}