CVE-2026-31672

MediumCVSS 5.5/10Last modified Nov 11, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: rt2x00usb: fix devres lifetime

USB drivers bind to USB interfaces and any device managed resources should have their lifetime tied to the interface rather than parent USB device. This avoids issues like memory leaks when drivers are unbound without their devices being physically disconnected (e.g. on probe deferral or configuration changes).

Fix the USB anchor lifetime so that it is released on driver unbind.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-401

Affected software

VendorProductVersions
LinuxLinux>= 8b4c0009313f3d42e2540e3e1f776097dd0db73d, < 64a457f6afbf15f984d95201a9a1e71eed3f9dd1; >= 8b4c0009313f3d42e2540e3e1f776097dd0db73d, < 65518a6965d527c53013947031f26754f6a4f6af; >= 8b4c0009313f3d42e2540e3e1f776097dd0db73d, < 15b233e33b35b927bd8d0044c15325564ea1ba24; >= 8b4c0009313f3d42e2540e3e1f776097dd0db73d, < 1de5c76bf40e9cdeebf54662f63011fb10fa452f; >= 8b4c0009313f3d42e2540e3e1f776097dd0db73d, < b245db719bc7e57abf48bd5701662b270c3880f7; >= 8b4c0009313f3d42e2540e3e1f776097dd0db73d, < e360d15fcb1e819eef49e3d4434d8050542eed16; >= 8b4c0009313f3d42e2540e3e1f776097dd0db73d, < c99f198841b41735796e2ddfcd573783fb552eb9; >= 8b4c0009313f3d42e2540e3e1f776097dd0db73d, < 25369b22223d1c56e42a0cd4ac9137349d5a898e
LinuxLinux4.7

References

Timeline

Published
Apr 24, 2026
Last modified
Nov 11, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-316737.8In the Linux kernel, the following vulnerability has been resolved: af_unix: read UNIX_DIAG_VFS data under unix_state_lock Exact UNIX diagCVE-2026-316747.1In the Linux kernel, the following vulnerability has been resolved: netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() Reject rCVE-2026-316757.8In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_netem: fix out-of-bounds access in packet corruption InCVE-2026-316767.5In the Linux kernel, the following vulnerability has been resolved: rxrpc: only handle RESPONSE during service challenge Only process RESPCVE-2026-316775.5In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - limit RX SG extraction by receive buffer budget Make CVE-2026-316787.8In the Linux kernel, the following vulnerability has been resolved: openvswitch: defer tunnel netdev_put to RCU release ovs_netdev_tunnel_CVE-2026-316797.1In the Linux kernel, the following vulnerability has been resolved: openvswitch: validate MPLS set/set_masked payload length validate_set(CVE-2026-31688.8A weakness has been identified in Tenda F453 1.0.0.3. This affects the function fromNatStaticSetting of the file /goform/NatStaticSetting ofCVE-2026-316807.8In the Linux kernel, the following vulnerability has been resolved: net: ipv6: flowlabel: defer exclusive option free until RCU teardown `CVE-2026-316815.5In the Linux kernel, the following vulnerability has been resolved: netfilter: xt_multiport: validate range encoding in checkentry ports_mCVE-2026-316829.1In the Linux kernel, the following vulnerability has been resolved: bridge: br_nd_send: linearize skb before parsing ND options br_nd_sendCVE-2026-316837.8In the Linux kernel, the following vulnerability has been resolved: batman-adv: avoid OGM aggregation when skb tailroom is insufficient Wh
CVE-2026-31672: Medium severity, CVSS 5.5 | Vulnix