{"cve":"CVE-2026-93141","nvd":{"published":"2026-09-17T17:18:09.130","modified":"2026-10-19T10:17:04.197","status":"Received","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: r8a66597: avoid double free of ep0_req in probe error path\n\nIf usb_add_gadget_udc() fails, r8a66597_probe() jumps to err_add_udc\nand frees ep0_req, then falls through to clean_up2 where ep0_req is\nfreed again when it is non-NULL.\n\nRemove the redundant free from err_add_udc and keep the cleanup in\nclean_up2 so the request is released exactly once.\n\nIssue found using a prototype static analysis tool\nand confirmed by code review.","cvss_v4":null,"cvss_v3":null,"cwes":[],"references":["https://git.kernel.org/stable/c/150d3f3c461345b6c9ae784912cf1e49c8e5ff6b","https://git.kernel.org/stable/c/41d541e3718db01668a4cd29815ee4b3b55f76d2","https://git.kernel.org/stable/c/6648c470918371766f6d368113dd2a4faebac93f","https://git.kernel.org/stable/c/6be64cca6527f7fc99b05abf54f22db91bbc116f","https://git.kernel.org/stable/c/7721cf32efa428bd9649f4a9b89fc85601df87de"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:55:23.253742848+00:00"},"epss":{"cve":"CVE-2026-93141","score":0.0022,"percentile":0.1241,"date":"2026-10-25"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}