Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
30160 vulnerabilities found for linux_kernel by linux
CVE-2026-64363 (GCVE-0-2026-64363)
Vulnerability from nvd – Published: 2026-07-25 08:50 – Updated: 2026-08-17 04:54
VLAI
EPSS
VEX
Title
HID: appleir: fix UAF on pending key_up_timer in remove()
Summary
In the Linux kernel, the following vulnerability has been resolved:
HID: appleir: fix UAF on pending key_up_timer in remove()
appleir_remove() runs hid_hw_stop() before timer_delete_sync().
hid_hw_stop() synchronously unregisters the HID input device via
hid_disconnect() -> hidinput_disconnect() -> input_unregister_device(),
which drops the last reference and frees the underlying input_dev when
no userspace handle holds it open.
key_up_tick() reads appleir->input_dev and calls input_report_key() /
input_sync() on it. The timer is armed from appleir_raw_event() with
a HZ/8 (~125 ms) timeout on every keydown and key-repeat report. If a
key was pressed shortly before the device is disconnected, the timer
can fire after hid_hw_stop() has freed input_dev but before the
teardown drains it.
A simple reorder is not sufficient. Putting the timer drain first
still leaves a window where a USB URB completion (raw_event) running
during hid_hw_stop() can call mod_timer() and re-arm the timer, which
then fires after hidinput_disconnect() has freed input_dev. The same
URB-completion window also lets raw_event() reach key_up(), key_down()
and battery_flat() directly, all of which dereference
appleir->input_dev.
Introduce a 'removing' flag on struct appleir, gated by the existing
spinlock. appleir_remove() sets the flag under the lock and then
shuts down the timer with timer_shutdown_sync(), which both drains any
in-flight callback and permanently disables further mod_timer() calls.
appleir_raw_event() and key_up_tick() bail out early if the flag is
set, so no path can arm or run the timer, or dereference
appleir->input_dev, after remove() has started tearing down.
The keyrepeat and flatbattery branches of appleir_raw_event()
previously called into the input layer without holding the spinlock;
take it now so the flag check is well-defined. This incidentally
closes a pre-existing read-side race on appleir->current_key in the
keyrepeat branch.
This bug is structurally a sibling of commit 4db2af929279 ("HID:
appletb-kbd: fix UAF in inactivity-timer cleanup path") and has been
present since the driver was introduced.
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
9a4a5574ce427c364d81746fc7fb82d86b5f1a7e , < 89ef67359672bf4cd6921524e39f61648fe38c0f
(git)
Affected: 9a4a5574ce427c364d81746fc7fb82d86b5f1a7e , < 3d30a0bb0e79621ae921b487835c56198adfafa3 (git) Affected: 9a4a5574ce427c364d81746fc7fb82d86b5f1a7e , < 37a52c61d4f78153c38ae1f7491dfcc8ac828dcf (git) Affected: 9a4a5574ce427c364d81746fc7fb82d86b5f1a7e , < 05e3decc55d1deca9410e0eb36466651fcbe57a5 (git) Affected: 9a4a5574ce427c364d81746fc7fb82d86b5f1a7e , < 3755f6e25776b8b12ddf062f9b573f05090e4034 (git) Affected: 9a4a5574ce427c364d81746fc7fb82d86b5f1a7e , < b363d964ca829c1761c9f04188dfa28f90b0f2d4 (git) Affected: 9a4a5574ce427c364d81746fc7fb82d86b5f1a7e , < 6b0838e86da88b1d3bff86f19761ff25af73eaca (git) Affected: 9a4a5574ce427c364d81746fc7fb82d86b5f1a7e , < 75fe87e19d8aff81eb2c64d15d244ab8da4de945 (git) |
|
| Linux | Linux |
Affected:
3.10
Unaffected: 0 , < 3.10 (semver) Unaffected: 5.10.261 , ≤ 5.10.* (semver) Unaffected: 5.15.212 , ≤ 5.15.* (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.97 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/hid/hid-appleir.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "89ef67359672bf4cd6921524e39f61648fe38c0f",
"status": "affected",
"version": "9a4a5574ce427c364d81746fc7fb82d86b5f1a7e",
"versionType": "git"
},
{
"lessThan": "3d30a0bb0e79621ae921b487835c56198adfafa3",
"status": "affected",
"version": "9a4a5574ce427c364d81746fc7fb82d86b5f1a7e",
"versionType": "git"
},
{
"lessThan": "37a52c61d4f78153c38ae1f7491dfcc8ac828dcf",
"status": "affected",
"version": "9a4a5574ce427c364d81746fc7fb82d86b5f1a7e",
"versionType": "git"
},
{
"lessThan": "05e3decc55d1deca9410e0eb36466651fcbe57a5",
"status": "affected",
"version": "9a4a5574ce427c364d81746fc7fb82d86b5f1a7e",
"versionType": "git"
},
{
"lessThan": "3755f6e25776b8b12ddf062f9b573f05090e4034",
"status": "affected",
"version": "9a4a5574ce427c364d81746fc7fb82d86b5f1a7e",
"versionType": "git"
},
{
"lessThan": "b363d964ca829c1761c9f04188dfa28f90b0f2d4",
"status": "affected",
"version": "9a4a5574ce427c364d81746fc7fb82d86b5f1a7e",
"versionType": "git"
},
{
"lessThan": "6b0838e86da88b1d3bff86f19761ff25af73eaca",
"status": "affected",
"version": "9a4a5574ce427c364d81746fc7fb82d86b5f1a7e",
"versionType": "git"
},
{
"lessThan": "75fe87e19d8aff81eb2c64d15d244ab8da4de945",
"status": "affected",
"version": "9a4a5574ce427c364d81746fc7fb82d86b5f1a7e",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/hid/hid-appleir.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.10"
},
{
"lessThan": "3.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "3.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: appleir: fix UAF on pending key_up_timer in remove()\n\nappleir_remove() runs hid_hw_stop() before timer_delete_sync().\nhid_hw_stop() synchronously unregisters the HID input device via\nhid_disconnect() -\u003e hidinput_disconnect() -\u003e input_unregister_device(),\nwhich drops the last reference and frees the underlying input_dev when\nno userspace handle holds it open.\n\nkey_up_tick() reads appleir-\u003einput_dev and calls input_report_key() /\ninput_sync() on it. The timer is armed from appleir_raw_event() with\na HZ/8 (~125 ms) timeout on every keydown and key-repeat report. If a\nkey was pressed shortly before the device is disconnected, the timer\ncan fire after hid_hw_stop() has freed input_dev but before the\nteardown drains it.\n\nA simple reorder is not sufficient. Putting the timer drain first\nstill leaves a window where a USB URB completion (raw_event) running\nduring hid_hw_stop() can call mod_timer() and re-arm the timer, which\nthen fires after hidinput_disconnect() has freed input_dev. The same\nURB-completion window also lets raw_event() reach key_up(), key_down()\nand battery_flat() directly, all of which dereference\nappleir-\u003einput_dev.\n\nIntroduce a \u0027removing\u0027 flag on struct appleir, gated by the existing\nspinlock. appleir_remove() sets the flag under the lock and then\nshuts down the timer with timer_shutdown_sync(), which both drains any\nin-flight callback and permanently disables further mod_timer() calls.\nappleir_raw_event() and key_up_tick() bail out early if the flag is\nset, so no path can arm or run the timer, or dereference\nappleir-\u003einput_dev, after remove() has started tearing down.\n\nThe keyrepeat and flatbattery branches of appleir_raw_event()\npreviously called into the input layer without holding the spinlock;\ntake it now so the flag check is well-defined. This incidentally\ncloses a pre-existing read-side race on appleir-\u003ecurrent_key in the\nkeyrepeat branch.\n\nThis bug is structurally a sibling of commit 4db2af929279 (\"HID:\nappletb-kbd: fix UAF in inactivity-timer cleanup path\") and has been\npresent since the driver was introduced."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:54:10.084Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/89ef67359672bf4cd6921524e39f61648fe38c0f"
},
{
"url": "https://git.kernel.org/stable/c/3d30a0bb0e79621ae921b487835c56198adfafa3"
},
{
"url": "https://git.kernel.org/stable/c/37a52c61d4f78153c38ae1f7491dfcc8ac828dcf"
},
{
"url": "https://git.kernel.org/stable/c/05e3decc55d1deca9410e0eb36466651fcbe57a5"
},
{
"url": "https://git.kernel.org/stable/c/3755f6e25776b8b12ddf062f9b573f05090e4034"
},
{
"url": "https://git.kernel.org/stable/c/b363d964ca829c1761c9f04188dfa28f90b0f2d4"
},
{
"url": "https://git.kernel.org/stable/c/6b0838e86da88b1d3bff86f19761ff25af73eaca"
},
{
"url": "https://git.kernel.org/stable/c/75fe87e19d8aff81eb2c64d15d244ab8da4de945"
}
],
"title": "HID: appleir: fix UAF on pending key_up_timer in remove()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64363",
"datePublished": "2026-07-25T08:50:18.824Z",
"dateReserved": "2026-07-19T15:36:31.783Z",
"dateUpdated": "2026-08-17T04:54:10.084Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64362 (GCVE-0-2026-64362)
Vulnerability from nvd – Published: 2026-07-25 08:50 – Updated: 2026-08-17 04:54
VLAI
EPSS
VEX
Title
HID: lg-g15: cancel pending work on remove to fix a use-after-free
Summary
In the Linux kernel, the following vulnerability has been resolved:
HID: lg-g15: cancel pending work on remove to fix a use-after-free
lg_g15_data is allocated with devm and holds a work item. The report
handlers schedule that work straight from device input.
lg_g15_event() and lg_g15_v2_event() do it on the backlight cycle key,
and lg_g510_leds_event() does it too. The worker dereferences the
lg_g15_data back through container_of.
The driver had no remove callback and never cancelled the work. So if a
report scheduled the work and the keyboard was then unplugged, devres
freed lg_g15_data while the work was still pending or running, and the
worker touched freed memory. This is a use-after-free. It is reachable
as a race on device unplug.
Add a remove callback that cancels the work before devres frees the
state. g15->work is only initialized for the models that schedule it
(G15, G15 v2, G510). The G13 and Z-10 leave it zeroed, so guard the
cancel on g15->work.func to avoid cancelling a work that was never set
up. The g15 NULL test mirrors the one already in lg_g15_raw_event().
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
97b741aba918c4143f4208d2421d08ff215c1b49 , < 3b9a3919aac6977262f04d5365c0456877522a44
(git)
Affected: 97b741aba918c4143f4208d2421d08ff215c1b49 , < 4aef9676c26dff8723b56834951cfc6b618f0986 (git) Affected: 97b741aba918c4143f4208d2421d08ff215c1b49 , < acce9dee807f21184fff19ad17c8ed464247e7f7 (git) Affected: 97b741aba918c4143f4208d2421d08ff215c1b49 , < 33cd1a000daf929356aacf2b191d31714ff0615e (git) Affected: 97b741aba918c4143f4208d2421d08ff215c1b49 , < dfc6e61f83113cc18346b6988f07271c0063357d (git) Affected: 97b741aba918c4143f4208d2421d08ff215c1b49 , < 4d0d51bc12d246accbfbb94de05d729c68c9b8fb (git) Affected: 97b741aba918c4143f4208d2421d08ff215c1b49 , < 8131f4226688c4be5f30874d167e44dab838eb09 (git) Affected: 97b741aba918c4143f4208d2421d08ff215c1b49 , < 7705b4140d188ce22656f6e541ae7ef834c7e11a (git) |
|
| Linux | Linux |
Affected:
5.5
Unaffected: 0 , < 5.5 (semver) Unaffected: 5.10.261 , ≤ 5.10.* (semver) Unaffected: 5.15.212 , ≤ 5.15.* (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.96 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/hid/hid-lg-g15.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "3b9a3919aac6977262f04d5365c0456877522a44",
"status": "affected",
"version": "97b741aba918c4143f4208d2421d08ff215c1b49",
"versionType": "git"
},
{
"lessThan": "4aef9676c26dff8723b56834951cfc6b618f0986",
"status": "affected",
"version": "97b741aba918c4143f4208d2421d08ff215c1b49",
"versionType": "git"
},
{
"lessThan": "acce9dee807f21184fff19ad17c8ed464247e7f7",
"status": "affected",
"version": "97b741aba918c4143f4208d2421d08ff215c1b49",
"versionType": "git"
},
{
"lessThan": "33cd1a000daf929356aacf2b191d31714ff0615e",
"status": "affected",
"version": "97b741aba918c4143f4208d2421d08ff215c1b49",
"versionType": "git"
},
{
"lessThan": "dfc6e61f83113cc18346b6988f07271c0063357d",
"status": "affected",
"version": "97b741aba918c4143f4208d2421d08ff215c1b49",
"versionType": "git"
},
{
"lessThan": "4d0d51bc12d246accbfbb94de05d729c68c9b8fb",
"status": "affected",
"version": "97b741aba918c4143f4208d2421d08ff215c1b49",
"versionType": "git"
},
{
"lessThan": "8131f4226688c4be5f30874d167e44dab838eb09",
"status": "affected",
"version": "97b741aba918c4143f4208d2421d08ff215c1b49",
"versionType": "git"
},
{
"lessThan": "7705b4140d188ce22656f6e541ae7ef834c7e11a",
"status": "affected",
"version": "97b741aba918c4143f4208d2421d08ff215c1b49",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/hid/hid-lg-g15.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.5"
},
{
"lessThan": "5.5",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "5.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "5.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "5.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "5.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "5.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "5.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "5.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: lg-g15: cancel pending work on remove to fix a use-after-free\n\nlg_g15_data is allocated with devm and holds a work item. The report\nhandlers schedule that work straight from device input.\nlg_g15_event() and lg_g15_v2_event() do it on the backlight cycle key,\nand lg_g510_leds_event() does it too. The worker dereferences the\nlg_g15_data back through container_of.\n\nThe driver had no remove callback and never cancelled the work. So if a\nreport scheduled the work and the keyboard was then unplugged, devres\nfreed lg_g15_data while the work was still pending or running, and the\nworker touched freed memory. This is a use-after-free. It is reachable\nas a race on device unplug.\n\nAdd a remove callback that cancels the work before devres frees the\nstate. g15-\u003ework is only initialized for the models that schedule it\n(G15, G15 v2, G510). The G13 and Z-10 leave it zeroed, so guard the\ncancel on g15-\u003ework.func to avoid cancelling a work that was never set\nup. The g15 NULL test mirrors the one already in lg_g15_raw_event()."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:54:08.962Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/3b9a3919aac6977262f04d5365c0456877522a44"
},
{
"url": "https://git.kernel.org/stable/c/4aef9676c26dff8723b56834951cfc6b618f0986"
},
{
"url": "https://git.kernel.org/stable/c/acce9dee807f21184fff19ad17c8ed464247e7f7"
},
{
"url": "https://git.kernel.org/stable/c/33cd1a000daf929356aacf2b191d31714ff0615e"
},
{
"url": "https://git.kernel.org/stable/c/dfc6e61f83113cc18346b6988f07271c0063357d"
},
{
"url": "https://git.kernel.org/stable/c/4d0d51bc12d246accbfbb94de05d729c68c9b8fb"
},
{
"url": "https://git.kernel.org/stable/c/8131f4226688c4be5f30874d167e44dab838eb09"
},
{
"url": "https://git.kernel.org/stable/c/7705b4140d188ce22656f6e541ae7ef834c7e11a"
}
],
"title": "HID: lg-g15: cancel pending work on remove to fix a use-after-free",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64362",
"datePublished": "2026-07-25T08:50:18.008Z",
"dateReserved": "2026-07-19T15:36:31.783Z",
"dateUpdated": "2026-08-17T04:54:08.962Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64361 (GCVE-0-2026-64361)
Vulnerability from nvd – Published: 2026-07-25 08:50 – Updated: 2026-08-17 04:54
VLAI
EPSS
VEX
Title
hfs/hfsplus: fix u32 overflow in check_and_correct_requested_length
Summary
In the Linux kernel, the following vulnerability has been resolved:
hfs/hfsplus: fix u32 overflow in check_and_correct_requested_length
check_and_correct_requested_length() compares (off + len) against
node_size using u32 arithmetic. When the caller passes a large len
value (e.g. from an underflowed subtraction in hfs_brec_remove()),
off + len can wrap past 2^32 and produce a small result, causing the
bounds check to pass when it should fail.
For example, with off=14 and len=0xFFFFFFF2 (underflowed from
data_off - keyoffset - size in hfs_brec_remove), off + len wraps to 6,
which is less than a typical node_size of 512, so the check passes and
the subsequent memmove reads ~4GB past the node buffer.
Fix this by widening the addition to u64 before comparing against
node_size. This prevents the u32 wrap while keeping the logic
straightforward.
Severity
7.8 (High)
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
67ecc81f6492275c9c54280532f558483c99c90e , < c8dd112173c02adf539fe2ad34a45f5e0068780d
(git)
Affected: a1a60e79502279f996e55052f50cc14919020475 , < fc9d1447ca3cdc78d2e4ace1ce1f3a7c77ca08b1 (git) Affected: fe2891a9c43ab87d1a210d61e6438ca6936e2f62 , < 671c3fcc2ad31c1311ea6414382a2d95104ae1b9 (git) Affected: 384a66b89f9540a9a8cb0f48807697dfabaece4c , < b6a481642ea1977be2f84dc08c5affd742c177e7 (git) Affected: efc095b35b23297e419c2ab4fc1ed1a8f0781a29 , < 7399c3baee7bb622a92f0b895cd4d3009a693f2b (git) Affected: a431930c9bac518bf99d6b1da526a7f37ddee8d8 , < 607217f7ad419b53926f71e3f75001813bbc08ad (git) Affected: a431930c9bac518bf99d6b1da526a7f37ddee8d8 , < c25d3c931a63e762fcaa9cb125b901c53b62403f (git) Affected: a431930c9bac518bf99d6b1da526a7f37ddee8d8 , < 966cb76fb2857a4242cab6ea2ea17acf818a3da7 (git) Affected: e7d2dc2421e821e4045775e6dc226378328de6f6 (git) Affected: fc7f732984ec91f30be3e574e0644066d07f2b78 (git) Affected: eec522fd0d28106b14a59ab2d658605febe4a3bb (git) Affected: 5.10.241 , < 5.10.261 (semver) Affected: 5.15.190 , < 5.15.212 (semver) Affected: 6.1.149 , < 6.1.178 (semver) Affected: 6.6.103 , < 6.6.145 (semver) Affected: 6.12.43 , < 6.12.97 (semver) Affected: 5.4.297 , < 5.5 (semver) Affected: 6.15.11 , < 6.16 (semver) Affected: 6.16.2 , < 6.17 (semver) |
|
| Linux | Linux |
Affected:
6.17
Unaffected: 0 , < 6.17 (semver) Unaffected: 5.10.261 , ≤ 5.10.* (semver) Unaffected: 5.15.212 , ≤ 5.15.* (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.97 , ≤ 6.12.* (semver) Unaffected: 6.18.40 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/hfs/bnode.c",
"fs/hfsplus/hfsplus_fs.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c8dd112173c02adf539fe2ad34a45f5e0068780d",
"status": "affected",
"version": "67ecc81f6492275c9c54280532f558483c99c90e",
"versionType": "git"
},
{
"lessThan": "fc9d1447ca3cdc78d2e4ace1ce1f3a7c77ca08b1",
"status": "affected",
"version": "a1a60e79502279f996e55052f50cc14919020475",
"versionType": "git"
},
{
"lessThan": "671c3fcc2ad31c1311ea6414382a2d95104ae1b9",
"status": "affected",
"version": "fe2891a9c43ab87d1a210d61e6438ca6936e2f62",
"versionType": "git"
},
{
"lessThan": "b6a481642ea1977be2f84dc08c5affd742c177e7",
"status": "affected",
"version": "384a66b89f9540a9a8cb0f48807697dfabaece4c",
"versionType": "git"
},
{
"lessThan": "7399c3baee7bb622a92f0b895cd4d3009a693f2b",
"status": "affected",
"version": "efc095b35b23297e419c2ab4fc1ed1a8f0781a29",
"versionType": "git"
},
{
"lessThan": "607217f7ad419b53926f71e3f75001813bbc08ad",
"status": "affected",
"version": "a431930c9bac518bf99d6b1da526a7f37ddee8d8",
"versionType": "git"
},
{
"lessThan": "c25d3c931a63e762fcaa9cb125b901c53b62403f",
"status": "affected",
"version": "a431930c9bac518bf99d6b1da526a7f37ddee8d8",
"versionType": "git"
},
{
"lessThan": "966cb76fb2857a4242cab6ea2ea17acf818a3da7",
"status": "affected",
"version": "a431930c9bac518bf99d6b1da526a7f37ddee8d8",
"versionType": "git"
},
{
"status": "affected",
"version": "e7d2dc2421e821e4045775e6dc226378328de6f6",
"versionType": "git"
},
{
"status": "affected",
"version": "fc7f732984ec91f30be3e574e0644066d07f2b78",
"versionType": "git"
},
{
"status": "affected",
"version": "eec522fd0d28106b14a59ab2d658605febe4a3bb",
"versionType": "git"
},
{
"lessThan": "5.10.261",
"status": "affected",
"version": "5.10.241",
"versionType": "semver"
},
{
"lessThan": "5.15.212",
"status": "affected",
"version": "5.15.190",
"versionType": "semver"
},
{
"lessThan": "6.1.178",
"status": "affected",
"version": "6.1.149",
"versionType": "semver"
},
{
"lessThan": "6.6.145",
"status": "affected",
"version": "6.6.103",
"versionType": "semver"
},
{
"lessThan": "6.12.97",
"status": "affected",
"version": "6.12.43",
"versionType": "semver"
},
{
"lessThan": "5.5",
"status": "affected",
"version": "5.4.297",
"versionType": "semver"
},
{
"lessThan": "6.16",
"status": "affected",
"version": "6.15.11",
"versionType": "semver"
},
{
"lessThan": "6.17",
"status": "affected",
"version": "6.16.2",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/hfs/bnode.c",
"fs/hfsplus/hfsplus_fs.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.17"
},
{
"lessThan": "6.17",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "5.10.241",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "5.15.190",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "6.1.149",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "6.6.103",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "6.12.43",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "6.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "6.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.4.297",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.15.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.16.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nhfs/hfsplus: fix u32 overflow in check_and_correct_requested_length\n\ncheck_and_correct_requested_length() compares (off + len) against\nnode_size using u32 arithmetic. When the caller passes a large len\nvalue (e.g. from an underflowed subtraction in hfs_brec_remove()),\noff + len can wrap past 2^32 and produce a small result, causing the\nbounds check to pass when it should fail.\n\nFor example, with off=14 and len=0xFFFFFFF2 (underflowed from\ndata_off - keyoffset - size in hfs_brec_remove), off + len wraps to 6,\nwhich is less than a typical node_size of 512, so the check passes and\nthe subsequent memmove reads ~4GB past the node buffer.\n\nFix this by widening the addition to u64 before comparing against\nnode_size. This prevents the u32 wrap while keeping the logic\nstraightforward."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable HFS/HFS+ B-tree operations are reachable through local filesystem syscalls such as removexattr() and rename() after a crafted volume is mounted. No network protocol directly supplies the malformed B-tree metadata.\nAC:L - A crafted B-tree deterministically produces the length underflow and u32 addition wrap; no race or condition outside the attacker\u0027s control is required.\nPR:L - Although mounting HFS/HFS+ requires init-namespace CAP_SYS_ADMIN, an unprivileged user with ordinary write access to a file on an already mounted crafted volume can trigger the flaw through user.* xattr removal or permitted rename operations.\nUI:N - The attacker can invoke the triggering filesystem syscall directly once the crafted volume is mounted; no action by another user is required.\nS:U - The corruption occurs in the kernel while processing filesystem metadata and does not cross a separate virtualization, IOMMU, or other security authority boundary.\nC:H - The wrapped near-4-GiB copy performs out-of-bounds reads and, in HFS+, can walk beyond the node\u0027s page-pointer array, providing a defensible path to broad kernel-memory disclosure.\nI:H - The affected move, copy, clear, and write paths can write beyond the B-tree node buffer; the huge memmove is therefore exploitable memory corruption rather than a read-only crash.\nA:H - The enormous out-of-bounds memory operation can reliably cause a kernel oops or panic and can corrupt large regions of kernel memory, producing complete system unavailability."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:54:07.849Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c8dd112173c02adf539fe2ad34a45f5e0068780d"
},
{
"url": "https://git.kernel.org/stable/c/fc9d1447ca3cdc78d2e4ace1ce1f3a7c77ca08b1"
},
{
"url": "https://git.kernel.org/stable/c/671c3fcc2ad31c1311ea6414382a2d95104ae1b9"
},
{
"url": "https://git.kernel.org/stable/c/b6a481642ea1977be2f84dc08c5affd742c177e7"
},
{
"url": "https://git.kernel.org/stable/c/7399c3baee7bb622a92f0b895cd4d3009a693f2b"
},
{
"url": "https://git.kernel.org/stable/c/607217f7ad419b53926f71e3f75001813bbc08ad"
},
{
"url": "https://git.kernel.org/stable/c/c25d3c931a63e762fcaa9cb125b901c53b62403f"
},
{
"url": "https://git.kernel.org/stable/c/966cb76fb2857a4242cab6ea2ea17acf818a3da7"
}
],
"title": "hfs/hfsplus: fix u32 overflow in check_and_correct_requested_length",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64361",
"datePublished": "2026-07-25T08:50:17.345Z",
"dateReserved": "2026-07-19T15:36:31.783Z",
"dateUpdated": "2026-08-17T04:54:07.849Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64360 (GCVE-0-2026-64360)
Vulnerability from nvd – Published: 2026-07-25 08:50 – Updated: 2026-08-17 04:54
VLAI
EPSS
VEX
Title
hfs/hfsplus: zero-initialize buffer in hfs_bnode_read
Summary
In the Linux kernel, the following vulnerability has been resolved:
hfs/hfsplus: zero-initialize buffer in hfs_bnode_read
hfs_bnode_read() can return early without writing to the output buffer
when is_bnode_offset_valid() fails or when check_and_correct_requested_
length() corrects the length to zero. Callers such as hfs_bnode_read_
u16() and hfs_bnode_read_u8() pass stack-allocated buffers and use the
result unconditionally, leading to KMSAN uninit-value reports.
Rather than initializing at each individual call site, zero the buffer
at the start of hfs_bnode_read() before any validation checks. This
ensures all callers in both hfs and hfsplus get a deterministic zero
value regardless of which early-return path is taken.
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
67ecc81f6492275c9c54280532f558483c99c90e , < 34684a04777358b2b40ac729e54c8e45359e46b3
(git)
Affected: a1a60e79502279f996e55052f50cc14919020475 , < 0b189b2204f1a2612dc68f8d139fb5b80539e710 (git) Affected: fe2891a9c43ab87d1a210d61e6438ca6936e2f62 , < 8f72fd25a57a457866350359ddd27a43caa62c95 (git) Affected: 384a66b89f9540a9a8cb0f48807697dfabaece4c , < 16ca053c2be5f4f3044dccf7fc19237dc820d394 (git) Affected: efc095b35b23297e419c2ab4fc1ed1a8f0781a29 , < d2afc7ecee476f9251dd87444f7fb6a424410922 (git) Affected: a431930c9bac518bf99d6b1da526a7f37ddee8d8 , < f3461b84a4865d9b5e70fbb71da72ae044a3bcd2 (git) Affected: a431930c9bac518bf99d6b1da526a7f37ddee8d8 , < d5b45bad75cd2730b8452aed4d3b20a2b2a12576 (git) Affected: a431930c9bac518bf99d6b1da526a7f37ddee8d8 , < d67aadee19ffdf3cc8520c5a4f4d5b2916d30baf (git) Affected: e7d2dc2421e821e4045775e6dc226378328de6f6 (git) Affected: fc7f732984ec91f30be3e574e0644066d07f2b78 (git) Affected: eec522fd0d28106b14a59ab2d658605febe4a3bb (git) Affected: 5.10.241 , < 5.10.261 (semver) Affected: 5.15.190 , < 5.15.212 (semver) Affected: 6.1.149 , < 6.1.178 (semver) Affected: 6.6.103 , < 6.6.145 (semver) Affected: 6.12.43 , < 6.12.96 (semver) Affected: 5.4.297 , < 5.5 (semver) Affected: 6.15.11 , < 6.16 (semver) Affected: 6.16.2 , < 6.17 (semver) |
|
| Linux | Linux |
Affected:
6.17
Unaffected: 0 , < 6.17 (semver) Unaffected: 5.10.261 , ≤ 5.10.* (semver) Unaffected: 5.15.212 , ≤ 5.15.* (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.96 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/hfs/bnode.c",
"fs/hfsplus/bnode.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "34684a04777358b2b40ac729e54c8e45359e46b3",
"status": "affected",
"version": "67ecc81f6492275c9c54280532f558483c99c90e",
"versionType": "git"
},
{
"lessThan": "0b189b2204f1a2612dc68f8d139fb5b80539e710",
"status": "affected",
"version": "a1a60e79502279f996e55052f50cc14919020475",
"versionType": "git"
},
{
"lessThan": "8f72fd25a57a457866350359ddd27a43caa62c95",
"status": "affected",
"version": "fe2891a9c43ab87d1a210d61e6438ca6936e2f62",
"versionType": "git"
},
{
"lessThan": "16ca053c2be5f4f3044dccf7fc19237dc820d394",
"status": "affected",
"version": "384a66b89f9540a9a8cb0f48807697dfabaece4c",
"versionType": "git"
},
{
"lessThan": "d2afc7ecee476f9251dd87444f7fb6a424410922",
"status": "affected",
"version": "efc095b35b23297e419c2ab4fc1ed1a8f0781a29",
"versionType": "git"
},
{
"lessThan": "f3461b84a4865d9b5e70fbb71da72ae044a3bcd2",
"status": "affected",
"version": "a431930c9bac518bf99d6b1da526a7f37ddee8d8",
"versionType": "git"
},
{
"lessThan": "d5b45bad75cd2730b8452aed4d3b20a2b2a12576",
"status": "affected",
"version": "a431930c9bac518bf99d6b1da526a7f37ddee8d8",
"versionType": "git"
},
{
"lessThan": "d67aadee19ffdf3cc8520c5a4f4d5b2916d30baf",
"status": "affected",
"version": "a431930c9bac518bf99d6b1da526a7f37ddee8d8",
"versionType": "git"
},
{
"status": "affected",
"version": "e7d2dc2421e821e4045775e6dc226378328de6f6",
"versionType": "git"
},
{
"status": "affected",
"version": "fc7f732984ec91f30be3e574e0644066d07f2b78",
"versionType": "git"
},
{
"status": "affected",
"version": "eec522fd0d28106b14a59ab2d658605febe4a3bb",
"versionType": "git"
},
{
"lessThan": "5.10.261",
"status": "affected",
"version": "5.10.241",
"versionType": "semver"
},
{
"lessThan": "5.15.212",
"status": "affected",
"version": "5.15.190",
"versionType": "semver"
},
{
"lessThan": "6.1.178",
"status": "affected",
"version": "6.1.149",
"versionType": "semver"
},
{
"lessThan": "6.6.145",
"status": "affected",
"version": "6.6.103",
"versionType": "semver"
},
{
"lessThan": "6.12.96",
"status": "affected",
"version": "6.12.43",
"versionType": "semver"
},
{
"lessThan": "5.5",
"status": "affected",
"version": "5.4.297",
"versionType": "semver"
},
{
"lessThan": "6.16",
"status": "affected",
"version": "6.15.11",
"versionType": "semver"
},
{
"lessThan": "6.17",
"status": "affected",
"version": "6.16.2",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/hfs/bnode.c",
"fs/hfsplus/bnode.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.17"
},
{
"lessThan": "6.17",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "5.10.241",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "5.15.190",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "6.1.149",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "6.6.103",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "6.12.43",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "6.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "6.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.4.297",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.15.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.16.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nhfs/hfsplus: zero-initialize buffer in hfs_bnode_read\n\nhfs_bnode_read() can return early without writing to the output buffer\nwhen is_bnode_offset_valid() fails or when check_and_correct_requested_\nlength() corrects the length to zero. Callers such as hfs_bnode_read_\nu16() and hfs_bnode_read_u8() pass stack-allocated buffers and use the\nresult unconditionally, leading to KMSAN uninit-value reports.\n\nRather than initializing at each individual call site, zero the buffer\nat the start of hfs_bnode_read() before any validation checks. This\nensures all callers in both hfs and hfsplus get a deterministic zero\nvalue regardless of which early-return path is taken."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:54:06.743Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/34684a04777358b2b40ac729e54c8e45359e46b3"
},
{
"url": "https://git.kernel.org/stable/c/0b189b2204f1a2612dc68f8d139fb5b80539e710"
},
{
"url": "https://git.kernel.org/stable/c/8f72fd25a57a457866350359ddd27a43caa62c95"
},
{
"url": "https://git.kernel.org/stable/c/16ca053c2be5f4f3044dccf7fc19237dc820d394"
},
{
"url": "https://git.kernel.org/stable/c/d2afc7ecee476f9251dd87444f7fb6a424410922"
},
{
"url": "https://git.kernel.org/stable/c/f3461b84a4865d9b5e70fbb71da72ae044a3bcd2"
},
{
"url": "https://git.kernel.org/stable/c/d5b45bad75cd2730b8452aed4d3b20a2b2a12576"
},
{
"url": "https://git.kernel.org/stable/c/d67aadee19ffdf3cc8520c5a4f4d5b2916d30baf"
}
],
"title": "hfs/hfsplus: zero-initialize buffer in hfs_bnode_read",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64360",
"datePublished": "2026-07-25T08:50:16.573Z",
"dateReserved": "2026-07-19T15:36:31.783Z",
"dateUpdated": "2026-08-17T04:54:06.743Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64359 (GCVE-0-2026-64359)
Vulnerability from nvd – Published: 2026-07-25 08:50 – Updated: 2026-08-17 04:54
VLAI
EPSS
VEX
Title
nilfs2: reject CLEAN_SEGMENTS ioctl with out-of-range segment numbers
Summary
In the Linux kernel, the following vulnerability has been resolved:
nilfs2: reject CLEAN_SEGMENTS ioctl with out-of-range segment numbers
Syzbot reported a hung task in nilfs_transaction_begin() where multiple
tasks performing chmod() on a nilfs2 mount blocked for over 143 seconds
waiting to acquire ns_segctor_sem for read:
INFO: task syz.0.17:5918 blocked for more than 143 seconds.
Call Trace:
schedule+0x164/0x360
rwsem_down_read_slowpath+0x6d9/0x940
down_read+0x99/0x2e0
nilfs_transaction_begin+0x364/0x710 fs/nilfs2/segment.c:221
nilfs_setattr+0x124/0x2c0 fs/nilfs2/inode.c:921
notify_change+0xc1a/0xf40
chmod_common+0x273/0x4a0
do_fchmodat+0x12d/0x230
The writer holding ns_segctor_sem was a concurrent
NILFS_IOCTL_CLEAN_SEGMENTS caller, stuck inside printk while emitting
per-element warnings from nilfs_sufile_updatev():
__nilfs_msg+0x373/0x450 fs/nilfs2/super.c:78
nilfs_sufile_updatev+0x21c/0x6d0 fs/nilfs2/sufile.c:186
nilfs_sufile_freev fs/nilfs2/sufile.h:93 [inline]
nilfs_free_segments fs/nilfs2/segment.c:1140 [inline]
nilfs_segctor_collect_blocks fs/nilfs2/segment.c:1261 [inline]
nilfs_segctor_do_construct+0x1f55/0x76c0
nilfs_clean_segments+0x3bd/0xa50
nilfs_ioctl_clean_segments fs/nilfs2/ioctl.c:922 [inline]
nilfs_ioctl+0x261f/0x2780
The root cause is that user-supplied segment numbers are not validated
before nilfs_clean_segments() begins doing work; the range check on
each segnum is performed deep inside the call chain by
nilfs_sufile_updatev(), which emits a nilfs_warn() per invalid entry
while still holding the segctor lock and the sufile mi_sem. Under load
(repeated invocations across multiple mounts saturating the global
printk path), the cumulative printk latency keeps ns_segctor_sem held
long enough to trip the hung_task watchdog, blocking concurrent
operations such as chmod() that need ns_segctor_sem for read.
Fix by validating the contents of kbufs[4] in nilfs_clean_segments()
immediately after acquiring ns_segctor_sem via nilfs_transaction_lock().
Holding ns_segctor_sem serializes the check against
nilfs_ioctl_resize(), which can modify ns_nsegments, so the validation
uses a consistent value. Out-of-range segment numbers are rejected
with -EINVAL before any segment-cleaning work begins, so the bad
entries never reach the per-element diagnostic path inside
nilfs_sufile_updatev().
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
071cb4b81987a28c7ac2702003cff3e61684a630 , < 3ed388ec3b8922383d1e2d4432d7bd4cbbf8364e
(git)
Affected: 071cb4b81987a28c7ac2702003cff3e61684a630 , < 876c98e0fc65f071680c03c2e2ee3ef7ff9ca078 (git) Affected: 071cb4b81987a28c7ac2702003cff3e61684a630 , < 39607452b1400c7bf748f15122df4d058b768c5b (git) Affected: 071cb4b81987a28c7ac2702003cff3e61684a630 , < 286f77d002a337735c0846d7480a82d9cda2aa31 (git) Affected: 071cb4b81987a28c7ac2702003cff3e61684a630 , < 0789f0a6710713254a08f3a7d2ecbb6d1cbcf0aa (git) Affected: 071cb4b81987a28c7ac2702003cff3e61684a630 , < 223463c488b0554212a94de971ea538eb2805fc7 (git) Affected: 071cb4b81987a28c7ac2702003cff3e61684a630 , < d26aef771b4f6923da9f89d6d5b70d8def5853de (git) Affected: 071cb4b81987a28c7ac2702003cff3e61684a630 , < 0e7a690fe435f8d5ea3feb7c1d8d73ba7e8b8aa9 (git) |
|
| Linux | Linux |
Affected:
2.6.31
Unaffected: 0 , < 2.6.31 (semver) Unaffected: 5.10.261 , ≤ 5.10.* (semver) Unaffected: 5.15.212 , ≤ 5.15.* (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.96 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/nilfs2/segment.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "3ed388ec3b8922383d1e2d4432d7bd4cbbf8364e",
"status": "affected",
"version": "071cb4b81987a28c7ac2702003cff3e61684a630",
"versionType": "git"
},
{
"lessThan": "876c98e0fc65f071680c03c2e2ee3ef7ff9ca078",
"status": "affected",
"version": "071cb4b81987a28c7ac2702003cff3e61684a630",
"versionType": "git"
},
{
"lessThan": "39607452b1400c7bf748f15122df4d058b768c5b",
"status": "affected",
"version": "071cb4b81987a28c7ac2702003cff3e61684a630",
"versionType": "git"
},
{
"lessThan": "286f77d002a337735c0846d7480a82d9cda2aa31",
"status": "affected",
"version": "071cb4b81987a28c7ac2702003cff3e61684a630",
"versionType": "git"
},
{
"lessThan": "0789f0a6710713254a08f3a7d2ecbb6d1cbcf0aa",
"status": "affected",
"version": "071cb4b81987a28c7ac2702003cff3e61684a630",
"versionType": "git"
},
{
"lessThan": "223463c488b0554212a94de971ea538eb2805fc7",
"status": "affected",
"version": "071cb4b81987a28c7ac2702003cff3e61684a630",
"versionType": "git"
},
{
"lessThan": "d26aef771b4f6923da9f89d6d5b70d8def5853de",
"status": "affected",
"version": "071cb4b81987a28c7ac2702003cff3e61684a630",
"versionType": "git"
},
{
"lessThan": "0e7a690fe435f8d5ea3feb7c1d8d73ba7e8b8aa9",
"status": "affected",
"version": "071cb4b81987a28c7ac2702003cff3e61684a630",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/nilfs2/segment.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.31"
},
{
"lessThan": "2.6.31",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "2.6.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "2.6.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "2.6.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "2.6.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "2.6.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "2.6.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "2.6.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.31",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnilfs2: reject CLEAN_SEGMENTS ioctl with out-of-range segment numbers\n\nSyzbot reported a hung task in nilfs_transaction_begin() where multiple\ntasks performing chmod() on a nilfs2 mount blocked for over 143 seconds\nwaiting to acquire ns_segctor_sem for read:\n\n INFO: task syz.0.17:5918 blocked for more than 143 seconds.\n Call Trace:\n schedule+0x164/0x360\n rwsem_down_read_slowpath+0x6d9/0x940\n down_read+0x99/0x2e0\n nilfs_transaction_begin+0x364/0x710 fs/nilfs2/segment.c:221\n nilfs_setattr+0x124/0x2c0 fs/nilfs2/inode.c:921\n notify_change+0xc1a/0xf40\n chmod_common+0x273/0x4a0\n do_fchmodat+0x12d/0x230\n\nThe writer holding ns_segctor_sem was a concurrent\nNILFS_IOCTL_CLEAN_SEGMENTS caller, stuck inside printk while emitting\nper-element warnings from nilfs_sufile_updatev():\n\n __nilfs_msg+0x373/0x450 fs/nilfs2/super.c:78\n nilfs_sufile_updatev+0x21c/0x6d0 fs/nilfs2/sufile.c:186\n nilfs_sufile_freev fs/nilfs2/sufile.h:93 [inline]\n nilfs_free_segments fs/nilfs2/segment.c:1140 [inline]\n nilfs_segctor_collect_blocks fs/nilfs2/segment.c:1261 [inline]\n nilfs_segctor_do_construct+0x1f55/0x76c0\n nilfs_clean_segments+0x3bd/0xa50\n nilfs_ioctl_clean_segments fs/nilfs2/ioctl.c:922 [inline]\n nilfs_ioctl+0x261f/0x2780\n\nThe root cause is that user-supplied segment numbers are not validated\nbefore nilfs_clean_segments() begins doing work; the range check on\neach segnum is performed deep inside the call chain by\nnilfs_sufile_updatev(), which emits a nilfs_warn() per invalid entry\nwhile still holding the segctor lock and the sufile mi_sem. Under load\n(repeated invocations across multiple mounts saturating the global\nprintk path), the cumulative printk latency keeps ns_segctor_sem held\nlong enough to trip the hung_task watchdog, blocking concurrent\noperations such as chmod() that need ns_segctor_sem for read.\n\nFix by validating the contents of kbufs[4] in nilfs_clean_segments()\nimmediately after acquiring ns_segctor_sem via nilfs_transaction_lock().\nHolding ns_segctor_sem serializes the check against\nnilfs_ioctl_resize(), which can modify ns_nsegments, so the validation\nuses a consistent value. Out-of-range segment numbers are rejected\nwith -EINVAL before any segment-cleaning work begins, so the bad\nentries never reach the per-element diagnostic path inside\nnilfs_sufile_updatev()."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:54:05.599Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/3ed388ec3b8922383d1e2d4432d7bd4cbbf8364e"
},
{
"url": "https://git.kernel.org/stable/c/876c98e0fc65f071680c03c2e2ee3ef7ff9ca078"
},
{
"url": "https://git.kernel.org/stable/c/39607452b1400c7bf748f15122df4d058b768c5b"
},
{
"url": "https://git.kernel.org/stable/c/286f77d002a337735c0846d7480a82d9cda2aa31"
},
{
"url": "https://git.kernel.org/stable/c/0789f0a6710713254a08f3a7d2ecbb6d1cbcf0aa"
},
{
"url": "https://git.kernel.org/stable/c/223463c488b0554212a94de971ea538eb2805fc7"
},
{
"url": "https://git.kernel.org/stable/c/d26aef771b4f6923da9f89d6d5b70d8def5853de"
},
{
"url": "https://git.kernel.org/stable/c/0e7a690fe435f8d5ea3feb7c1d8d73ba7e8b8aa9"
}
],
"title": "nilfs2: reject CLEAN_SEGMENTS ioctl with out-of-range segment numbers",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64359",
"datePublished": "2026-07-25T08:50:15.947Z",
"dateReserved": "2026-07-19T15:36:31.782Z",
"dateUpdated": "2026-08-17T04:54:05.599Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64358 (GCVE-0-2026-64358)
Vulnerability from nvd – Published: 2026-07-25 08:50 – Updated: 2026-08-17 04:54
VLAI
EPSS
VEX
Title
media: mtk-jpeg: cancel workqueue on release for supported platforms only
Summary
In the Linux kernel, the following vulnerability has been resolved:
media: mtk-jpeg: cancel workqueue on release for supported platforms only
Since a recent fix the mtk_jpeg_release function cancels any pending
or running work present in the driver workqueue using
cancel_work_sync function.
Currently, only the multicore based variants use this workqueue and they
have the jpeg_worker platform data field initialized with a workqueue
callback function. For the others, this field value remain NULL by
default.
The cancel_work_sync function is unconditionally called in
mtk_jpeg_release function, even for the variants that do not use the
workqueue. This call generates a WARN_ON print in __flush_work because
the workqueue callback function presence check fails in __flush_work
function (used by cancel_work_sync).
So, to avoid these warnings, call cancel_work_sync only if a workqueue
callback is defined in platform data.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
2209fdae5c2f615930c9af1379c1cfca199ec5d8 , < 0fed0fc34ce734b4b8c2f6a467d38bddcb21dda9
(git)
Affected: 0498b27a1542021d90269d58347501d4c3ccd84e , < ac0774961a6ea174a71d4ffa39966edafbf7662d (git) Affected: 26506a30e0e26d612f82a7bf0e395626968a44e6 , < 973408ceab14555a8548b97c8cc7b54208c3f251 (git) Affected: 34c519feef3e4fcff1078dc8bdb25fbbbd10303f , < 4c4b4af4a9f278da096f0dbdb6b59594701d29bf (git) Affected: 34c519feef3e4fcff1078dc8bdb25fbbbd10303f , < b1845a227fda37b2fe5327df3ca0015d7e290235 (git) Affected: e78c39f720679fcf3a2eacd82725ec3ea2648301 (git) Affected: 6.6.140 , < 6.6.145 (semver) Affected: 6.12.86 , < 6.12.96 (semver) Affected: 6.18.27 , < 6.18.39 (semver) Affected: 7.0.4 , < 7.1 (semver) |
|
| Linux | Linux |
Affected:
7.1
Unaffected: 0 , < 7.1 (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.96 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "0fed0fc34ce734b4b8c2f6a467d38bddcb21dda9",
"status": "affected",
"version": "2209fdae5c2f615930c9af1379c1cfca199ec5d8",
"versionType": "git"
},
{
"lessThan": "ac0774961a6ea174a71d4ffa39966edafbf7662d",
"status": "affected",
"version": "0498b27a1542021d90269d58347501d4c3ccd84e",
"versionType": "git"
},
{
"lessThan": "973408ceab14555a8548b97c8cc7b54208c3f251",
"status": "affected",
"version": "26506a30e0e26d612f82a7bf0e395626968a44e6",
"versionType": "git"
},
{
"lessThan": "4c4b4af4a9f278da096f0dbdb6b59594701d29bf",
"status": "affected",
"version": "34c519feef3e4fcff1078dc8bdb25fbbbd10303f",
"versionType": "git"
},
{
"lessThan": "b1845a227fda37b2fe5327df3ca0015d7e290235",
"status": "affected",
"version": "34c519feef3e4fcff1078dc8bdb25fbbbd10303f",
"versionType": "git"
},
{
"status": "affected",
"version": "e78c39f720679fcf3a2eacd82725ec3ea2648301",
"versionType": "git"
},
{
"lessThan": "6.6.145",
"status": "affected",
"version": "6.6.140",
"versionType": "semver"
},
{
"lessThan": "6.12.96",
"status": "affected",
"version": "6.12.86",
"versionType": "semver"
},
{
"lessThan": "6.18.39",
"status": "affected",
"version": "6.18.27",
"versionType": "semver"
},
{
"lessThan": "7.1",
"status": "affected",
"version": "7.0.4",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "7.1"
},
{
"lessThan": "7.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "6.6.140",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "6.12.86",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "6.18.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "7.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "7.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "7.0.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: mtk-jpeg: cancel workqueue on release for supported platforms only\n\nSince a recent fix the mtk_jpeg_release function cancels any pending\nor running work present in the driver workqueue using\ncancel_work_sync function.\nCurrently, only the multicore based variants use this workqueue and they\nhave the jpeg_worker platform data field initialized with a workqueue\ncallback function. For the others, this field value remain NULL by\ndefault.\nThe cancel_work_sync function is unconditionally called in\nmtk_jpeg_release function, even for the variants that do not use the\nworkqueue. This call generates a WARN_ON print in __flush_work because\nthe workqueue callback function presence check fails in __flush_work\nfunction (used by cancel_work_sync).\n\nSo, to avoid these warnings, call cancel_work_sync only if a workqueue\ncallback is defined in platform data."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:54:04.458Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/0fed0fc34ce734b4b8c2f6a467d38bddcb21dda9"
},
{
"url": "https://git.kernel.org/stable/c/ac0774961a6ea174a71d4ffa39966edafbf7662d"
},
{
"url": "https://git.kernel.org/stable/c/973408ceab14555a8548b97c8cc7b54208c3f251"
},
{
"url": "https://git.kernel.org/stable/c/4c4b4af4a9f278da096f0dbdb6b59594701d29bf"
},
{
"url": "https://git.kernel.org/stable/c/b1845a227fda37b2fe5327df3ca0015d7e290235"
}
],
"title": "media: mtk-jpeg: cancel workqueue on release for supported platforms only",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64358",
"datePublished": "2026-07-25T08:50:15.303Z",
"dateReserved": "2026-07-19T15:36:31.782Z",
"dateUpdated": "2026-08-17T04:54:04.458Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64357 (GCVE-0-2026-64357)
Vulnerability from nvd – Published: 2026-07-25 08:50 – Updated: 2026-08-17 04:54
VLAI
EPSS
VEX
Title
xfs: fix exchmaps reservation limit check
Summary
In the Linux kernel, the following vulnerability has been resolved:
xfs: fix exchmaps reservation limit check
xfs_exchmaps_estimate_overhead() adds the bmbt and rmapbt
overhead to a local resblks variable, but the final UINT_MAX
check still tests req->resblks. That is the reservation value
from before the overhead was added.
The computed value is stored back in req->resblks and later passed
to xfs_trans_alloc(), whose block reservation argument is unsigned
int. Check the computed reservation so the existing limit applies
to the value that will be used.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
966ceafc7a437105ecfe1cadb3747b2965a260ca , < c597c8580d50127fc1221b5a5b653a94d49e23e3
(git)
Affected: 966ceafc7a437105ecfe1cadb3747b2965a260ca , < a62ef2d13d6e7270dd5e88c6082bf2d0edcd5112 (git) Affected: 966ceafc7a437105ecfe1cadb3747b2965a260ca , < 4707344b0d36d1012c8a1716e20167cd3afdd5f1 (git) Affected: 966ceafc7a437105ecfe1cadb3747b2965a260ca , < 0a5213bbff62b51c7d4999ac8c7e11ea57d00d45 (git) |
|
| Linux | Linux |
Affected:
6.10
Unaffected: 0 , < 6.10 (semver) Unaffected: 6.12.96 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/xfs/libxfs/xfs_exchmaps.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c597c8580d50127fc1221b5a5b653a94d49e23e3",
"status": "affected",
"version": "966ceafc7a437105ecfe1cadb3747b2965a260ca",
"versionType": "git"
},
{
"lessThan": "a62ef2d13d6e7270dd5e88c6082bf2d0edcd5112",
"status": "affected",
"version": "966ceafc7a437105ecfe1cadb3747b2965a260ca",
"versionType": "git"
},
{
"lessThan": "4707344b0d36d1012c8a1716e20167cd3afdd5f1",
"status": "affected",
"version": "966ceafc7a437105ecfe1cadb3747b2965a260ca",
"versionType": "git"
},
{
"lessThan": "0a5213bbff62b51c7d4999ac8c7e11ea57d00d45",
"status": "affected",
"version": "966ceafc7a437105ecfe1cadb3747b2965a260ca",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/xfs/libxfs/xfs_exchmaps.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.10"
},
{
"lessThan": "6.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfs: fix exchmaps reservation limit check\n\nxfs_exchmaps_estimate_overhead() adds the bmbt and rmapbt\noverhead to a local resblks variable, but the final UINT_MAX\ncheck still tests req-\u003eresblks. That is the reservation value\nfrom before the overhead was added.\n\nThe computed value is stored back in req-\u003eresblks and later passed\nto xfs_trans_alloc(), whose block reservation argument is unsigned\nint. Check the computed reservation so the existing limit applies\nto the value that will be used."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:54:03.348Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c597c8580d50127fc1221b5a5b653a94d49e23e3"
},
{
"url": "https://git.kernel.org/stable/c/a62ef2d13d6e7270dd5e88c6082bf2d0edcd5112"
},
{
"url": "https://git.kernel.org/stable/c/4707344b0d36d1012c8a1716e20167cd3afdd5f1"
},
{
"url": "https://git.kernel.org/stable/c/0a5213bbff62b51c7d4999ac8c7e11ea57d00d45"
}
],
"title": "xfs: fix exchmaps reservation limit check",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64357",
"datePublished": "2026-07-25T08:50:14.676Z",
"dateReserved": "2026-07-19T15:36:31.782Z",
"dateUpdated": "2026-08-17T04:54:03.348Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64356 (GCVE-0-2026-64356)
Vulnerability from nvd – Published: 2026-07-25 08:50 – Updated: 2026-08-17 04:54
VLAI
EPSS
VEX
Title
xfs: fix memory leak in xfs_dqinode_metadir_create()
Summary
In the Linux kernel, the following vulnerability has been resolved:
xfs: fix memory leak in xfs_dqinode_metadir_create()
If xfs_metadir_create() fails in xfs_dqinode_metadir_create(), the current
code returns directly, leaking the allocated update and transaction state.
If the subsequent commit fails, the caller-owned inode reference is left
behind.
Fix this memory leak by routing the create failure path through
xfs_metadir_cancel(). For both create and commit failures, finish and
release any inode returned to the caller, mirroring the unwind pattern in
xfs_metadir_mkdir().
The bug was first flagged by an experimental analysis tool we are
developing for kernel memory-management bugs while analyzing
v6.13-rc1. The tool is still under development and is not yet publicly
available. Manual inspection confirms that the bug is still
present in v7.1.1.
An x86_64 allyesconfig build showed no new warnings. Runtime validation
used kprobe fault injection during `mount -o uquota` on a metadir XFS
image. Injecting xfs_metadir_create() reproduced the old active-update path
that left mount stuck later in mount setup; after this change, the same
injection reported cancel_hits=1 and irele_hits=1. Injecting
xfs_metadir_commit() exercised the old inode-reference leak path; after
this change, it reported irele_hits=1.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
e80fbe1ad8eff7d7d1363e14f1e493d84dd37c84 , < c3d3d2212c2966973dd7d603c6c6e6ed6fc7fbe1
(git)
Affected: e80fbe1ad8eff7d7d1363e14f1e493d84dd37c84 , < 06a2e6dbaa26c0740ac76dfa66b0aedc78d05820 (git) Affected: e80fbe1ad8eff7d7d1363e14f1e493d84dd37c84 , < 45de375b25060edf46e20abb36521ba530336ceb (git) |
|
| Linux | Linux |
Affected:
6.13
Unaffected: 0 , < 6.13 (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/xfs/libxfs/xfs_dquot_buf.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c3d3d2212c2966973dd7d603c6c6e6ed6fc7fbe1",
"status": "affected",
"version": "e80fbe1ad8eff7d7d1363e14f1e493d84dd37c84",
"versionType": "git"
},
{
"lessThan": "06a2e6dbaa26c0740ac76dfa66b0aedc78d05820",
"status": "affected",
"version": "e80fbe1ad8eff7d7d1363e14f1e493d84dd37c84",
"versionType": "git"
},
{
"lessThan": "45de375b25060edf46e20abb36521ba530336ceb",
"status": "affected",
"version": "e80fbe1ad8eff7d7d1363e14f1e493d84dd37c84",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/xfs/libxfs/xfs_dquot_buf.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.13"
},
{
"lessThan": "6.13",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "6.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "6.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.13",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfs: fix memory leak in xfs_dqinode_metadir_create()\n\nIf xfs_metadir_create() fails in xfs_dqinode_metadir_create(), the current\ncode returns directly, leaking the allocated update and transaction state.\nIf the subsequent commit fails, the caller-owned inode reference is left\nbehind.\n\nFix this memory leak by routing the create failure path through\nxfs_metadir_cancel(). For both create and commit failures, finish and\nrelease any inode returned to the caller, mirroring the unwind pattern in\nxfs_metadir_mkdir().\n\nThe bug was first flagged by an experimental analysis tool we are\ndeveloping for kernel memory-management bugs while analyzing\nv6.13-rc1. The tool is still under development and is not yet publicly\navailable. Manual inspection confirms that the bug is still\npresent in v7.1.1.\n\nAn x86_64 allyesconfig build showed no new warnings. Runtime validation\nused kprobe fault injection during `mount -o uquota` on a metadir XFS\nimage. Injecting xfs_metadir_create() reproduced the old active-update path\nthat left mount stuck later in mount setup; after this change, the same\ninjection reported cancel_hits=1 and irele_hits=1. Injecting\nxfs_metadir_commit() exercised the old inode-reference leak path; after\nthis change, it reported irele_hits=1."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:54:02.246Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c3d3d2212c2966973dd7d603c6c6e6ed6fc7fbe1"
},
{
"url": "https://git.kernel.org/stable/c/06a2e6dbaa26c0740ac76dfa66b0aedc78d05820"
},
{
"url": "https://git.kernel.org/stable/c/45de375b25060edf46e20abb36521ba530336ceb"
}
],
"title": "xfs: fix memory leak in xfs_dqinode_metadir_create()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64356",
"datePublished": "2026-07-25T08:50:14.049Z",
"dateReserved": "2026-07-19T15:36:31.782Z",
"dateUpdated": "2026-08-17T04:54:02.246Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64355 (GCVE-0-2026-64355)
Vulnerability from nvd – Published: 2026-07-25 08:50 – Updated: 2026-08-17 04:54
VLAI
EPSS
VEX
Title
bpf: Reject fragmented frames in devmap
Summary
In the Linux kernel, the following vulnerability has been resolved:
bpf: Reject fragmented frames in devmap
Devmap broadcast redirects clone the packet for all but the last
destination.
For native XDP, that clone path copies only the linear xdp_frame data,
while fragmented frames keep skb_shared_info in tailroom outside the
linear area. Cloning such a frame leaves XDP_FLAGS_HAS_FRAGS set but
without valid frag metadata, and the later free path can interpret
uninitialized tail data as skb_shared_info, leading to an out-of-bounds
access during frame return.
Reject fragmented native XDP frames in dev_map_enqueue_clone().
Add the same restriction to the generic XDP clone path in
dev_map_redirect_clone(). Generic XDP represents fragmented packets as
nonlinear skbs, and rejecting them here keeps clone-based broadcast
support aligned between native and generic XDP.
Severity
9.8 (Critical)
Assigner
References
7 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
e624d4ed4aa8cc3c69d1359b0aaea539203ed266 , < 47baddc856ae7e93a565dd9deeb797999b179466
(git)
Affected: e624d4ed4aa8cc3c69d1359b0aaea539203ed266 , < 07a4c11ee8ef4abcb39d922e9e410ae269671cdf (git) Affected: e624d4ed4aa8cc3c69d1359b0aaea539203ed266 , < bccbab36ff228e0825eb85d9b0f9b8434cd0a399 (git) Affected: e624d4ed4aa8cc3c69d1359b0aaea539203ed266 , < c5b4f5efcb55c1af3fe44ff712d31b7fb098a831 (git) Affected: e624d4ed4aa8cc3c69d1359b0aaea539203ed266 , < a9bb2d9c798cb62a4050a991c27b752770c33afe (git) Affected: e624d4ed4aa8cc3c69d1359b0aaea539203ed266 , < 51d07c12ca411e692c424ecdabf077f1e61a61be (git) Affected: e624d4ed4aa8cc3c69d1359b0aaea539203ed266 , < aa496720618f1a6054f1c870bf10b4f6c99bf656 (git) |
|
| Linux | Linux |
Affected:
5.14
Unaffected: 0 , < 5.14 (semver) Unaffected: 5.15.212 , ≤ 5.15.* (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.96 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/bpf/devmap.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "47baddc856ae7e93a565dd9deeb797999b179466",
"status": "affected",
"version": "e624d4ed4aa8cc3c69d1359b0aaea539203ed266",
"versionType": "git"
},
{
"lessThan": "07a4c11ee8ef4abcb39d922e9e410ae269671cdf",
"status": "affected",
"version": "e624d4ed4aa8cc3c69d1359b0aaea539203ed266",
"versionType": "git"
},
{
"lessThan": "bccbab36ff228e0825eb85d9b0f9b8434cd0a399",
"status": "affected",
"version": "e624d4ed4aa8cc3c69d1359b0aaea539203ed266",
"versionType": "git"
},
{
"lessThan": "c5b4f5efcb55c1af3fe44ff712d31b7fb098a831",
"status": "affected",
"version": "e624d4ed4aa8cc3c69d1359b0aaea539203ed266",
"versionType": "git"
},
{
"lessThan": "a9bb2d9c798cb62a4050a991c27b752770c33afe",
"status": "affected",
"version": "e624d4ed4aa8cc3c69d1359b0aaea539203ed266",
"versionType": "git"
},
{
"lessThan": "51d07c12ca411e692c424ecdabf077f1e61a61be",
"status": "affected",
"version": "e624d4ed4aa8cc3c69d1359b0aaea539203ed266",
"versionType": "git"
},
{
"lessThan": "aa496720618f1a6054f1c870bf10b4f6c99bf656",
"status": "affected",
"version": "e624d4ed4aa8cc3c69d1359b0aaea539203ed266",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/bpf/devmap.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.14"
},
{
"lessThan": "5.14",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.14",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Reject fragmented frames in devmap\n\nDevmap broadcast redirects clone the packet for all but the last\ndestination.\n\nFor native XDP, that clone path copies only the linear xdp_frame data,\nwhile fragmented frames keep skb_shared_info in tailroom outside the\nlinear area. Cloning such a frame leaves XDP_FLAGS_HAS_FRAGS set but\nwithout valid frag metadata, and the later free path can interpret\nuninitialized tail data as skb_shared_info, leading to an out-of-bounds\naccess during frame return.\n\nReject fragmented native XDP frames in dev_map_enqueue_clone().\n\nAdd the same restriction to the generic XDP clone path in\ndev_map_redirect_clone(). Generic XDP represents fragmented packets as\nnonlinear skbs, and rejecting them here keeps clone-based broadcast\nsupport aligned between native and generic XDP."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - A remote peer can send an oversized packet that a fragment-capable NIC represents as a multi-buffer XDP frame, reaching the vulnerable devmap broadcast clone path on a configured forwarding host.\nAC:L - No race or uncontrollable timing condition is required; fragmented packets reliably enter the faulty clone path and can be sent repeatedly.\nPR:N - Although initial-namespace CAP_BPF and CAP_NET_ADMIN are needed to configure the XDP deployment, the attacker sending packets through the already-configured unauthenticated data path needs no privileges.\nUI:N - Packet reception and XDP processing occur automatically without victim action.\nS:U - The corruption compromises resources governed by the same host-kernel security authority and does not inherently cross a VM, IOMMU, or other distinct boundary.\nC:H - Uninitialized fragment descriptors are consumed as page references and can be used by scatter-gather transmitters for unintended DMA mappings, potentially exposing arbitrary kernel memory.\nI:H - An uninitialized fragment count can overrun fixed-size driver arrays, while bogus page references can cause invalid refcount decrements, premature frees, and exploitable kernel memory corruption.\nA:H - Invalid fragment metadata can fault during DMA mapping, transmission, or frame return and cause a kernel oops or panic; an attacker can trigger this repeatedly."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:54:01.161Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/47baddc856ae7e93a565dd9deeb797999b179466"
},
{
"url": "https://git.kernel.org/stable/c/07a4c11ee8ef4abcb39d922e9e410ae269671cdf"
},
{
"url": "https://git.kernel.org/stable/c/bccbab36ff228e0825eb85d9b0f9b8434cd0a399"
},
{
"url": "https://git.kernel.org/stable/c/c5b4f5efcb55c1af3fe44ff712d31b7fb098a831"
},
{
"url": "https://git.kernel.org/stable/c/a9bb2d9c798cb62a4050a991c27b752770c33afe"
},
{
"url": "https://git.kernel.org/stable/c/51d07c12ca411e692c424ecdabf077f1e61a61be"
},
{
"url": "https://git.kernel.org/stable/c/aa496720618f1a6054f1c870bf10b4f6c99bf656"
}
],
"title": "bpf: Reject fragmented frames in devmap",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64355",
"datePublished": "2026-07-25T08:50:13.410Z",
"dateReserved": "2026-07-19T15:36:31.782Z",
"dateUpdated": "2026-08-17T04:54:01.161Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64354 (GCVE-0-2026-64354)
Vulnerability from nvd – Published: 2026-07-25 08:50 – Updated: 2026-08-17 04:54
VLAI
EPSS
VEX
Title
bpf: Validate BTF repeated field counts before expansion
Summary
In the Linux kernel, the following vulnerability has been resolved:
bpf: Validate BTF repeated field counts before expansion
btf_parse_struct_metas() walks user-supplied BTF during BPF_BTF_LOAD,
and btf_repeat_fields() expands repeatable fields from array elements
into the fixed BTF_FIELDS_MAX scratch array used by btf_parse_fields().
The remaining-capacity check performs the expanded field count calculation
in u32. A malformed BTF can wrap that calculation, causing the check to
pass even when the expanded field count exceeds the scratch array
capacity. The following memcpy() can then write past the end of the
array.
Use checked addition and multiplication before copying repeated fields
and reject impossible counts.
Severity
7.8 (High)
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
797d73ee232dd1833dec4824bc53a22032e97c1c , < c5ff816d5f13900c3f1f3298cfcc61339e056e56
(git)
Affected: 797d73ee232dd1833dec4824bc53a22032e97c1c , < cd407de2ef5dc70f1970b343ffaa16186340fdfd (git) Affected: 797d73ee232dd1833dec4824bc53a22032e97c1c , < ff77d013b737c0f77d925e2f2c59f0cf3d76bd35 (git) Affected: 797d73ee232dd1833dec4824bc53a22032e97c1c , < b9452b594fd3aecbfd4aa0a6a1f741330a37dab7 (git) Affected: 6f957d972feee9b385ea3ae6530310a84e55ba71 (git) Affected: 6.11.6 , < 6.12 (semver) |
|
| Linux | Linux |
Affected:
6.12
Unaffected: 0 , < 6.12 (semver) Unaffected: 6.12.96 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/bpf/btf.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c5ff816d5f13900c3f1f3298cfcc61339e056e56",
"status": "affected",
"version": "797d73ee232dd1833dec4824bc53a22032e97c1c",
"versionType": "git"
},
{
"lessThan": "cd407de2ef5dc70f1970b343ffaa16186340fdfd",
"status": "affected",
"version": "797d73ee232dd1833dec4824bc53a22032e97c1c",
"versionType": "git"
},
{
"lessThan": "ff77d013b737c0f77d925e2f2c59f0cf3d76bd35",
"status": "affected",
"version": "797d73ee232dd1833dec4824bc53a22032e97c1c",
"versionType": "git"
},
{
"lessThan": "b9452b594fd3aecbfd4aa0a6a1f741330a37dab7",
"status": "affected",
"version": "797d73ee232dd1833dec4824bc53a22032e97c1c",
"versionType": "git"
},
{
"status": "affected",
"version": "6f957d972feee9b385ea3ae6530310a84e55ba71",
"versionType": "git"
},
{
"lessThan": "6.12",
"status": "affected",
"version": "6.11.6",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/bpf/btf.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.12"
},
{
"lessThan": "6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.11.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Validate BTF repeated field counts before expansion\n\nbtf_parse_struct_metas() walks user-supplied BTF during BPF_BTF_LOAD,\nand btf_repeat_fields() expands repeatable fields from array elements\ninto the fixed BTF_FIELDS_MAX scratch array used by btf_parse_fields().\n\nThe remaining-capacity check performs the expanded field count calculation\nin u32. A malformed BTF can wrap that calculation, causing the check to\npass even when the expanded field count exceeds the scratch array\ncapacity. The following memcpy() can then write past the end of the\narray.\n\nUse checked addition and multiplication before copying repeated fields\nand reject impossible counts."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The attacker reaches the vulnerable parser through the local bpf(BPF_BTF_LOAD) syscall; no network or physical path exists.\nAC:L - A compact, deterministic malformed BTF object triggers the arithmetic wrap and immediate out-of-bounds memcpy without a race or uncontrollable condition.\nPR:L - BPF_BTF_LOAD normally requires init-namespace CAP_BPF, but a delegated BPF token permits CAP_BPF in its user namespace. Thus a namespace-root attacker in a reasonably delegated container environment can reach it with low privileges.\nUI:N - The attacker invokes BPF_BTF_LOAD directly and requires no action from another user.\nS:U - The corruption occurs within the host kernel\u0027s security authority; resulting privilege escalation or container escape is standard kernel compromise rather than a CVSS scope change.\nC:H - The attacker-influenced kernel-stack overflow can corrupt control data and plausibly enable kernel code execution, which would expose arbitrary kernel memory.\nI:H - The vulnerable memcpy performs a large out-of-bounds kernel-stack write using attacker-influenced metadata records, making control-flow corruption and arbitrary kernel modification defensible.\nA:H - The expansion repeatedly overwrites beyond the stack array until it reaches control data, a guard page, or adjacent kernel memory, allowing a deterministic kernel oops, panic, or severe corruption."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:54:00.068Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c5ff816d5f13900c3f1f3298cfcc61339e056e56"
},
{
"url": "https://git.kernel.org/stable/c/cd407de2ef5dc70f1970b343ffaa16186340fdfd"
},
{
"url": "https://git.kernel.org/stable/c/ff77d013b737c0f77d925e2f2c59f0cf3d76bd35"
},
{
"url": "https://git.kernel.org/stable/c/b9452b594fd3aecbfd4aa0a6a1f741330a37dab7"
}
],
"title": "bpf: Validate BTF repeated field counts before expansion",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64354",
"datePublished": "2026-07-25T08:50:12.752Z",
"dateReserved": "2026-07-19T15:36:31.782Z",
"dateUpdated": "2026-08-17T04:54:00.068Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64353 (GCVE-0-2026-64353)
Vulnerability from nvd – Published: 2026-07-25 08:50 – Updated: 2026-08-17 04:53
VLAI
EPSS
VEX
Title
bpf: Keep dynamic inner array lookups nullable
Summary
In the Linux kernel, the following vulnerability has been resolved:
bpf: Keep dynamic inner array lookups nullable
An ARRAY_OF_MAPS can use an array created with BPF_F_INNER_MAP as its
inner map template. A concrete inner array with a different max_entries
value can then replace the template.
After a successful outer map lookup, the verifier represents the
resulting map pointer using the inner map template. Const-key lookup
nullness elision consequently uses the template max_entries even though
the runtime helper uses the concrete inner map max_entries.
Do not elide lookup result nullness for maps marked with BPF_F_INNER_MAP,
because the template max_entries does not prove that the key is in bounds
for the concrete runtime map.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
d2102f2f5d75a84dbab6ff890359f0bd4a18ca22 , < 0b92ad64d6e4bde85e6b9888404f9a7a2b65d269
(git)
Affected: d2102f2f5d75a84dbab6ff890359f0bd4a18ca22 , < d57db0d975053e01410c54e708a85b6d32ef2ebd (git) Affected: d2102f2f5d75a84dbab6ff890359f0bd4a18ca22 , < 53040a81ae57cdca8af8ac36fe4e661730cf7c6b (git) |
|
| Linux | Linux |
Affected:
6.14
Unaffected: 0 , < 6.14 (semver) Unaffected: 6.18.40 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/bpf/verifier.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "0b92ad64d6e4bde85e6b9888404f9a7a2b65d269",
"status": "affected",
"version": "d2102f2f5d75a84dbab6ff890359f0bd4a18ca22",
"versionType": "git"
},
{
"lessThan": "d57db0d975053e01410c54e708a85b6d32ef2ebd",
"status": "affected",
"version": "d2102f2f5d75a84dbab6ff890359f0bd4a18ca22",
"versionType": "git"
},
{
"lessThan": "53040a81ae57cdca8af8ac36fe4e661730cf7c6b",
"status": "affected",
"version": "d2102f2f5d75a84dbab6ff890359f0bd4a18ca22",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/bpf/verifier.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.14"
},
{
"lessThan": "6.14",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.14",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Keep dynamic inner array lookups nullable\n\nAn ARRAY_OF_MAPS can use an array created with BPF_F_INNER_MAP as its\ninner map template. A concrete inner array with a different max_entries\nvalue can then replace the template.\n\nAfter a successful outer map lookup, the verifier represents the\nresulting map pointer using the inner map template. Const-key lookup\nnullness elision consequently uses the template max_entries even though\nthe runtime helper uses the concrete inner map max_entries.\n\nDo not elide lookup result nullness for maps marked with BPF_F_INNER_MAP,\nbecause the template max_entries does not prove that the key is in bounds\nfor the concrete runtime map."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:53:58.950Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/0b92ad64d6e4bde85e6b9888404f9a7a2b65d269"
},
{
"url": "https://git.kernel.org/stable/c/d57db0d975053e01410c54e708a85b6d32ef2ebd"
},
{
"url": "https://git.kernel.org/stable/c/53040a81ae57cdca8af8ac36fe4e661730cf7c6b"
}
],
"title": "bpf: Keep dynamic inner array lookups nullable",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64353",
"datePublished": "2026-07-25T08:50:12.120Z",
"dateReserved": "2026-07-19T15:36:31.782Z",
"dateUpdated": "2026-08-17T04:53:58.950Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64352 (GCVE-0-2026-64352)
Vulnerability from nvd – Published: 2026-07-25 08:50 – Updated: 2026-08-17 04:53
VLAI
EPSS
VEX
Title
bpf: Allow LPM map access from sleepable BPF programs
Summary
In the Linux kernel, the following vulnerability has been resolved:
bpf: Allow LPM map access from sleepable BPF programs
trie_lookup_elem() annotates its rcu_dereference_check() walks with
only rcu_read_lock_bh_held(). Because rcu_dereference_check(p, c)
resolves to "c || rcu_read_lock_held()", this passes for XDP/NAPI and
classic RCU readers but fails for sleepable BPF programs, which enter
via __bpf_prog_enter_sleepable() and hold only rcu_read_lock_trace().
trie_update_elem() and trie_delete_elem() have the same problem in a
different form: they walk the trie with plain rcu_dereference(), which
asserts rcu_read_lock_held() unconditionally. Both are reachable from
sleepable BPF programs via the bpf_map_update_elem / bpf_map_delete_elem
helpers, and from the syscall path under classic rcu_read_lock(). In
the writer paths the trie is actually protected by trie->lock (an
rqspinlock taken across the walk); we never relied on the RCU read-side
lock to keep nodes alive there.
A sleepable LSM hook that ends up touching an LPM trie therefore
triggers lockdep on debug kernels:
=============================
WARNING: suspicious RCU usage
7.1.0-... Tainted: G E
-----------------------------
kernel/bpf/lpm_trie.c:249 suspicious rcu_dereference_check() usage!
1 lock held by net_tests/540:
#0: (rcu_tasks_trace_srcu_struct){....}-{0:0},
at: __bpf_prog_enter_sleepable+0x26/0x280
Call Trace:
dump_stack_lvl
lockdep_rcu_suspicious
trie_lookup_elem
bpf_prog_..._enforce_security_socket_connect
bpf_trampoline_...
security_socket_connect
__sys_connect
do_syscall_64
This is lockdep-only -- no UAF, since Tasks Trace RCU does serialize
against the trie's reclaim path -- but it spams the console once per
distinct callsite on every debug kernel running a sleepable BPF LSM
that touches an LPM trie, which is increasingly common.
For the lookup path, switch the rcu_dereference_check() annotation
from rcu_read_lock_bh_held() to bpf_rcu_lock_held(), which accepts all
three contexts (classic, BH, Tasks Trace). Other map types already
follow this convention.
For trie_update_elem() and trie_delete_elem(), annotate the walks as
rcu_dereference_protected(*p, 1) -- matching trie_free() in the same
file -- since trie->lock is held across the walk. rqspinlock has no
lockdep_map, so the predicate degenerates to '1' rather than
lockdep_is_held(&trie->lock); the protection is real but not
machine-verifiable. trie_get_next_key() also uses bare
rcu_dereference() but is reachable only from the BPF syscall, which
holds classic rcu_read_lock() before dispatching, so it is left
untouched.
Severity
No CVSS data available.
Assigner
References
7 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
694cea395fded425008e93cd90cfdf7a451674af , < f0967d4f1ba4323a3cb7dc8fdba74dd3a8caaf04
(git)
Affected: 694cea395fded425008e93cd90cfdf7a451674af , < 304ca50582f0c047370f85e13caec456f78c9fcc (git) Affected: 694cea395fded425008e93cd90cfdf7a451674af , < ec662a8b2cde01e76b37ccd4b992d0342299e69c (git) Affected: 694cea395fded425008e93cd90cfdf7a451674af , < 9bfdf4b81b0e56d47bc6c46c34a46638be716695 (git) Affected: 694cea395fded425008e93cd90cfdf7a451674af , < 57454944737f3ad9a8703aecbbb79713b513a94b (git) Affected: 694cea395fded425008e93cd90cfdf7a451674af , < bd6ad9a6b30498d845413e863fb95c6fab3babe3 (git) Affected: 694cea395fded425008e93cd90cfdf7a451674af , < 2f884d371fafea137afea504d49ee4a7c8d7985b (git) |
|
| Linux | Linux |
Affected:
5.14
Unaffected: 0 , < 5.14 (semver) Unaffected: 5.15.212 , ≤ 5.15.* (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.97 , ≤ 6.12.* (semver) Unaffected: 6.18.40 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/bpf/lpm_trie.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f0967d4f1ba4323a3cb7dc8fdba74dd3a8caaf04",
"status": "affected",
"version": "694cea395fded425008e93cd90cfdf7a451674af",
"versionType": "git"
},
{
"lessThan": "304ca50582f0c047370f85e13caec456f78c9fcc",
"status": "affected",
"version": "694cea395fded425008e93cd90cfdf7a451674af",
"versionType": "git"
},
{
"lessThan": "ec662a8b2cde01e76b37ccd4b992d0342299e69c",
"status": "affected",
"version": "694cea395fded425008e93cd90cfdf7a451674af",
"versionType": "git"
},
{
"lessThan": "9bfdf4b81b0e56d47bc6c46c34a46638be716695",
"status": "affected",
"version": "694cea395fded425008e93cd90cfdf7a451674af",
"versionType": "git"
},
{
"lessThan": "57454944737f3ad9a8703aecbbb79713b513a94b",
"status": "affected",
"version": "694cea395fded425008e93cd90cfdf7a451674af",
"versionType": "git"
},
{
"lessThan": "bd6ad9a6b30498d845413e863fb95c6fab3babe3",
"status": "affected",
"version": "694cea395fded425008e93cd90cfdf7a451674af",
"versionType": "git"
},
{
"lessThan": "2f884d371fafea137afea504d49ee4a7c8d7985b",
"status": "affected",
"version": "694cea395fded425008e93cd90cfdf7a451674af",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/bpf/lpm_trie.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.14"
},
{
"lessThan": "5.14",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.14",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Allow LPM map access from sleepable BPF programs\n\ntrie_lookup_elem() annotates its rcu_dereference_check() walks with\nonly rcu_read_lock_bh_held(). Because rcu_dereference_check(p, c)\nresolves to \"c || rcu_read_lock_held()\", this passes for XDP/NAPI and\nclassic RCU readers but fails for sleepable BPF programs, which enter\nvia __bpf_prog_enter_sleepable() and hold only rcu_read_lock_trace().\n\ntrie_update_elem() and trie_delete_elem() have the same problem in a\ndifferent form: they walk the trie with plain rcu_dereference(), which\nasserts rcu_read_lock_held() unconditionally. Both are reachable from\nsleepable BPF programs via the bpf_map_update_elem / bpf_map_delete_elem\nhelpers, and from the syscall path under classic rcu_read_lock(). In\nthe writer paths the trie is actually protected by trie-\u003elock (an\nrqspinlock taken across the walk); we never relied on the RCU read-side\nlock to keep nodes alive there.\n\nA sleepable LSM hook that ends up touching an LPM trie therefore\ntriggers lockdep on debug kernels:\n\n =============================\n WARNING: suspicious RCU usage\n 7.1.0-... Tainted: G E\n -----------------------------\n kernel/bpf/lpm_trie.c:249 suspicious rcu_dereference_check() usage!\n 1 lock held by net_tests/540:\n #0: (rcu_tasks_trace_srcu_struct){....}-{0:0},\n at: __bpf_prog_enter_sleepable+0x26/0x280\n Call Trace:\n dump_stack_lvl\n lockdep_rcu_suspicious\n trie_lookup_elem\n bpf_prog_..._enforce_security_socket_connect\n bpf_trampoline_...\n security_socket_connect\n __sys_connect\n do_syscall_64\n\nThis is lockdep-only -- no UAF, since Tasks Trace RCU does serialize\nagainst the trie\u0027s reclaim path -- but it spams the console once per\ndistinct callsite on every debug kernel running a sleepable BPF LSM\nthat touches an LPM trie, which is increasingly common.\n\nFor the lookup path, switch the rcu_dereference_check() annotation\nfrom rcu_read_lock_bh_held() to bpf_rcu_lock_held(), which accepts all\nthree contexts (classic, BH, Tasks Trace). Other map types already\nfollow this convention.\n\nFor trie_update_elem() and trie_delete_elem(), annotate the walks as\nrcu_dereference_protected(*p, 1) -- matching trie_free() in the same\nfile -- since trie-\u003elock is held across the walk. rqspinlock has no\nlockdep_map, so the predicate degenerates to \u00271\u0027 rather than\nlockdep_is_held(\u0026trie-\u003elock); the protection is real but not\nmachine-verifiable. trie_get_next_key() also uses bare\nrcu_dereference() but is reachable only from the BPF syscall, which\nholds classic rcu_read_lock() before dispatching, so it is left\nuntouched."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:53:57.862Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f0967d4f1ba4323a3cb7dc8fdba74dd3a8caaf04"
},
{
"url": "https://git.kernel.org/stable/c/304ca50582f0c047370f85e13caec456f78c9fcc"
},
{
"url": "https://git.kernel.org/stable/c/ec662a8b2cde01e76b37ccd4b992d0342299e69c"
},
{
"url": "https://git.kernel.org/stable/c/9bfdf4b81b0e56d47bc6c46c34a46638be716695"
},
{
"url": "https://git.kernel.org/stable/c/57454944737f3ad9a8703aecbbb79713b513a94b"
},
{
"url": "https://git.kernel.org/stable/c/bd6ad9a6b30498d845413e863fb95c6fab3babe3"
},
{
"url": "https://git.kernel.org/stable/c/2f884d371fafea137afea504d49ee4a7c8d7985b"
}
],
"title": "bpf: Allow LPM map access from sleepable BPF programs",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64352",
"datePublished": "2026-07-25T08:50:11.522Z",
"dateReserved": "2026-07-19T15:36:31.782Z",
"dateUpdated": "2026-08-17T04:53:57.862Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64351 (GCVE-0-2026-64351)
Vulnerability from nvd – Published: 2026-07-25 08:50 – Updated: 2026-08-17 04:53
VLAI
EPSS
VEX
Title
net: usb: kalmia: bound RX frame length in kalmia_rx_fixup()
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: usb: kalmia: bound RX frame length in kalmia_rx_fixup()
kalmia_rx_fixup() computes usb_packet_length = skb->len - (2 *
KALMIA_HEADER_LENGTH) as a u16, guarded only by a pre-loop check that
skb->len is at least KALMIA_HEADER_LENGTH, which is 6. A device can
deliver a short bulk-IN frame with skb->len in the 6 to 11 range, or
leave a short trailing remainder on a later loop iteration. Either case
underflows usb_packet_length to about 65530.
That bypasses the usb_packet_length < ether_packet_length truncation path.
The device-supplied ether_packet_length, a le16 up to 65535 read from
header_start[2], then drives a memcmp() and the following skb_trim() and
skb_pull() past the end of the rx buffer. The rx buffer is hard_mtu * 10,
which is 14000 bytes. That is an out of bounds read.
Require both the start and end framing headers to be present before
subtracting them, on every loop iteration.
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
d40261236e8e278cb1936cb5e934262971692b10 , < 391706889a5112feafdc0c68db3ecc7ed325d09c
(git)
Affected: d40261236e8e278cb1936cb5e934262971692b10 , < aa4eef2cbb66ea3dfcfc24bdce798dd78a81b54b (git) Affected: d40261236e8e278cb1936cb5e934262971692b10 , < 2d04c37ed4e1d0f733ad39ec35b5a5d8818b4f4a (git) Affected: d40261236e8e278cb1936cb5e934262971692b10 , < 46ab32870d010e9a057bc5659cea22b7e728ca88 (git) Affected: d40261236e8e278cb1936cb5e934262971692b10 , < c466097d85d52f3aa200736cb4759e66d4bbf6e3 (git) Affected: d40261236e8e278cb1936cb5e934262971692b10 , < e24eb271061db384a3c3ef6f107fe515e68ef222 (git) Affected: d40261236e8e278cb1936cb5e934262971692b10 , < 51e65f1d78457ea4f9513d90ab22c9dccbb35110 (git) Affected: d40261236e8e278cb1936cb5e934262971692b10 , < 47b6bcef6e679593d2e86e04ee72c46a4e2f7139 (git) |
|
| Linux | Linux |
Affected:
3.0
Unaffected: 0 , < 3.0 (semver) Unaffected: 5.10.261 , ≤ 5.10.* (semver) Unaffected: 5.15.212 , ≤ 5.15.* (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.96 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/usb/kalmia.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "391706889a5112feafdc0c68db3ecc7ed325d09c",
"status": "affected",
"version": "d40261236e8e278cb1936cb5e934262971692b10",
"versionType": "git"
},
{
"lessThan": "aa4eef2cbb66ea3dfcfc24bdce798dd78a81b54b",
"status": "affected",
"version": "d40261236e8e278cb1936cb5e934262971692b10",
"versionType": "git"
},
{
"lessThan": "2d04c37ed4e1d0f733ad39ec35b5a5d8818b4f4a",
"status": "affected",
"version": "d40261236e8e278cb1936cb5e934262971692b10",
"versionType": "git"
},
{
"lessThan": "46ab32870d010e9a057bc5659cea22b7e728ca88",
"status": "affected",
"version": "d40261236e8e278cb1936cb5e934262971692b10",
"versionType": "git"
},
{
"lessThan": "c466097d85d52f3aa200736cb4759e66d4bbf6e3",
"status": "affected",
"version": "d40261236e8e278cb1936cb5e934262971692b10",
"versionType": "git"
},
{
"lessThan": "e24eb271061db384a3c3ef6f107fe515e68ef222",
"status": "affected",
"version": "d40261236e8e278cb1936cb5e934262971692b10",
"versionType": "git"
},
{
"lessThan": "51e65f1d78457ea4f9513d90ab22c9dccbb35110",
"status": "affected",
"version": "d40261236e8e278cb1936cb5e934262971692b10",
"versionType": "git"
},
{
"lessThan": "47b6bcef6e679593d2e86e04ee72c46a4e2f7139",
"status": "affected",
"version": "d40261236e8e278cb1936cb5e934262971692b10",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/usb/kalmia.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.0"
},
{
"lessThan": "3.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "3.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: usb: kalmia: bound RX frame length in kalmia_rx_fixup()\n\nkalmia_rx_fixup() computes usb_packet_length = skb-\u003elen - (2 *\nKALMIA_HEADER_LENGTH) as a u16, guarded only by a pre-loop check that\nskb-\u003elen is at least KALMIA_HEADER_LENGTH, which is 6. A device can\ndeliver a short bulk-IN frame with skb-\u003elen in the 6 to 11 range, or\nleave a short trailing remainder on a later loop iteration. Either case\nunderflows usb_packet_length to about 65530.\n\nThat bypasses the usb_packet_length \u003c ether_packet_length truncation path.\nThe device-supplied ether_packet_length, a le16 up to 65535 read from\nheader_start[2], then drives a memcmp() and the following skb_trim() and\nskb_pull() past the end of the rx buffer. The rx buffer is hard_mtu * 10,\nwhich is 14000 bytes. That is an out of bounds read.\n\nRequire both the start and end framing headers to be present before\nsubtracting them, on every loop iteration."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:53:56.750Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/391706889a5112feafdc0c68db3ecc7ed325d09c"
},
{
"url": "https://git.kernel.org/stable/c/aa4eef2cbb66ea3dfcfc24bdce798dd78a81b54b"
},
{
"url": "https://git.kernel.org/stable/c/2d04c37ed4e1d0f733ad39ec35b5a5d8818b4f4a"
},
{
"url": "https://git.kernel.org/stable/c/46ab32870d010e9a057bc5659cea22b7e728ca88"
},
{
"url": "https://git.kernel.org/stable/c/c466097d85d52f3aa200736cb4759e66d4bbf6e3"
},
{
"url": "https://git.kernel.org/stable/c/e24eb271061db384a3c3ef6f107fe515e68ef222"
},
{
"url": "https://git.kernel.org/stable/c/51e65f1d78457ea4f9513d90ab22c9dccbb35110"
},
{
"url": "https://git.kernel.org/stable/c/47b6bcef6e679593d2e86e04ee72c46a4e2f7139"
}
],
"title": "net: usb: kalmia: bound RX frame length in kalmia_rx_fixup()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64351",
"datePublished": "2026-07-25T08:50:10.882Z",
"dateReserved": "2026-07-19T15:36:31.782Z",
"dateUpdated": "2026-08-17T04:53:56.750Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64350 (GCVE-0-2026-64350)
Vulnerability from nvd – Published: 2026-07-25 08:50 – Updated: 2026-08-17 04:53
VLAI
EPSS
VEX
Title
usb: cdnsp: fix stream context array leak in cdnsp_alloc_stream_info()
Summary
In the Linux kernel, the following vulnerability has been resolved:
usb: cdnsp: fix stream context array leak in cdnsp_alloc_stream_info()
cdnsp_alloc_stream_info() allocates stream_info->stream_ctx_array with
cdnsp_alloc_stream_ctx(). If a later stream ring allocation or stream
mapping update fails, the error path frees the allocated stream rings
and stream_rings array, but leaves stream_ctx_array allocated.
Free the stream context array before falling through to the stream_rings
cleanup path.
Severity
No CVSS data available.
Assigner
References
7 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
3d82904559f4f5a2622db1b21de3edf2eded7664 , < 37283f5a47127fbdea567749a2110766af53d18d
(git)
Affected: 3d82904559f4f5a2622db1b21de3edf2eded7664 , < cb8e9391b7f4f77d112c51910cd7c355a337ef76 (git) Affected: 3d82904559f4f5a2622db1b21de3edf2eded7664 , < fde3c095e1d48e0ac3ab8bc32905da42fe58a36a (git) Affected: 3d82904559f4f5a2622db1b21de3edf2eded7664 , < d9643bbe93a6aee24edee1a86e0303aa74bcd320 (git) Affected: 3d82904559f4f5a2622db1b21de3edf2eded7664 , < c00826e87bb75e14e0381b05da5f18ffd0241ab6 (git) Affected: 3d82904559f4f5a2622db1b21de3edf2eded7664 , < 963075c4da0cd43b3d17b107c355e1eb0ee64a58 (git) Affected: 3d82904559f4f5a2622db1b21de3edf2eded7664 , < 3348f444a4ce43dd5c2d1aa41634cb6eff33aa64 (git) |
|
| Linux | Linux |
Affected:
5.12
Unaffected: 0 , < 5.12 (semver) Unaffected: 5.15.212 , ≤ 5.15.* (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.96 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/usb/cdns3/cdnsp-mem.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "37283f5a47127fbdea567749a2110766af53d18d",
"status": "affected",
"version": "3d82904559f4f5a2622db1b21de3edf2eded7664",
"versionType": "git"
},
{
"lessThan": "cb8e9391b7f4f77d112c51910cd7c355a337ef76",
"status": "affected",
"version": "3d82904559f4f5a2622db1b21de3edf2eded7664",
"versionType": "git"
},
{
"lessThan": "fde3c095e1d48e0ac3ab8bc32905da42fe58a36a",
"status": "affected",
"version": "3d82904559f4f5a2622db1b21de3edf2eded7664",
"versionType": "git"
},
{
"lessThan": "d9643bbe93a6aee24edee1a86e0303aa74bcd320",
"status": "affected",
"version": "3d82904559f4f5a2622db1b21de3edf2eded7664",
"versionType": "git"
},
{
"lessThan": "c00826e87bb75e14e0381b05da5f18ffd0241ab6",
"status": "affected",
"version": "3d82904559f4f5a2622db1b21de3edf2eded7664",
"versionType": "git"
},
{
"lessThan": "963075c4da0cd43b3d17b107c355e1eb0ee64a58",
"status": "affected",
"version": "3d82904559f4f5a2622db1b21de3edf2eded7664",
"versionType": "git"
},
{
"lessThan": "3348f444a4ce43dd5c2d1aa41634cb6eff33aa64",
"status": "affected",
"version": "3d82904559f4f5a2622db1b21de3edf2eded7664",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/usb/cdns3/cdnsp-mem.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.12"
},
{
"lessThan": "5.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: cdnsp: fix stream context array leak in cdnsp_alloc_stream_info()\n\ncdnsp_alloc_stream_info() allocates stream_info-\u003estream_ctx_array with\ncdnsp_alloc_stream_ctx(). If a later stream ring allocation or stream\nmapping update fails, the error path frees the allocated stream rings\nand stream_rings array, but leaves stream_ctx_array allocated.\n\nFree the stream context array before falling through to the stream_rings\ncleanup path."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:53:55.657Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/37283f5a47127fbdea567749a2110766af53d18d"
},
{
"url": "https://git.kernel.org/stable/c/cb8e9391b7f4f77d112c51910cd7c355a337ef76"
},
{
"url": "https://git.kernel.org/stable/c/fde3c095e1d48e0ac3ab8bc32905da42fe58a36a"
},
{
"url": "https://git.kernel.org/stable/c/d9643bbe93a6aee24edee1a86e0303aa74bcd320"
},
{
"url": "https://git.kernel.org/stable/c/c00826e87bb75e14e0381b05da5f18ffd0241ab6"
},
{
"url": "https://git.kernel.org/stable/c/963075c4da0cd43b3d17b107c355e1eb0ee64a58"
},
{
"url": "https://git.kernel.org/stable/c/3348f444a4ce43dd5c2d1aa41634cb6eff33aa64"
}
],
"title": "usb: cdnsp: fix stream context array leak in cdnsp_alloc_stream_info()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64350",
"datePublished": "2026-07-25T08:50:10.270Z",
"dateReserved": "2026-07-19T15:36:31.782Z",
"dateUpdated": "2026-08-17T04:53:55.657Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64349 (GCVE-0-2026-64349)
Vulnerability from nvd – Published: 2026-07-25 08:50 – Updated: 2026-08-17 04:53
VLAI
EPSS
VEX
Title
usb: dwc3: fix dwc3_readl() and dwc3_writel() calls in dwc3_ulpi_setup()
Summary
In the Linux kernel, the following vulnerability has been resolved:
usb: dwc3: fix dwc3_readl() and dwc3_writel() calls in dwc3_ulpi_setup()
The dwc3_ulpi_setup() calls the register read and write calls with
dwc3->regs when both these calls take the dwc3 structure directly.
Chnage these two calls to fix the following sparse warning, and
possibly a nasty bug in the dwc3_ulpi_setup() code:
drivers/usb/dwc3/core.c:796:45: warning: incorrect type in argument 1 (different address spaces)
drivers/usb/dwc3/core.c:796:45: expected struct dwc3 *dwc
drivers/usb/dwc3/core.c:796:45: got void [noderef] __iomem *regs
drivers/usb/dwc3/core.c:798:40: warning: incorrect type in argument 1 (different address spaces)
drivers/usb/dwc3/core.c:798:40: expected struct dwc3 *dwc
drivers/usb/dwc3/core.c:798:40: got void [noderef] __iomem *regs
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
476ee6389120e1900290b46081b3a12b54e05672 , < 41a4e80d5af04855e68ac88f5e2cd07fa67287f8
(git)
Affected: 9accc68b1cf0a2b220f51d53641128bb32598070 , < 4349e487a1149ff33b65d53427b8aca57f2e4578 (git) Affected: 9accc68b1cf0a2b220f51d53641128bb32598070 , < e0f844d9d74200d311c6438a0f04270834ba5365 (git) Affected: 6.18.32 , < 6.18.40 (semver) |
|
| Linux | Linux |
Affected:
7.0
Unaffected: 0 , < 7.0 (semver) Unaffected: 6.18.40 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/usb/dwc3/core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "41a4e80d5af04855e68ac88f5e2cd07fa67287f8",
"status": "affected",
"version": "476ee6389120e1900290b46081b3a12b54e05672",
"versionType": "git"
},
{
"lessThan": "4349e487a1149ff33b65d53427b8aca57f2e4578",
"status": "affected",
"version": "9accc68b1cf0a2b220f51d53641128bb32598070",
"versionType": "git"
},
{
"lessThan": "e0f844d9d74200d311c6438a0f04270834ba5365",
"status": "affected",
"version": "9accc68b1cf0a2b220f51d53641128bb32598070",
"versionType": "git"
},
{
"lessThan": "6.18.40",
"status": "affected",
"version": "6.18.32",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/usb/dwc3/core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "7.0"
},
{
"lessThan": "7.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "6.18.32",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "7.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "7.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: dwc3: fix dwc3_readl() and dwc3_writel() calls in dwc3_ulpi_setup()\n\nThe dwc3_ulpi_setup() calls the register read and write calls with\ndwc3-\u003eregs when both these calls take the dwc3 structure directly.\n\nChnage these two calls to fix the following sparse warning, and\npossibly a nasty bug in the dwc3_ulpi_setup() code:\n\ndrivers/usb/dwc3/core.c:796:45: warning: incorrect type in argument 1 (different address spaces)\ndrivers/usb/dwc3/core.c:796:45: expected struct dwc3 *dwc\ndrivers/usb/dwc3/core.c:796:45: got void [noderef] __iomem *regs\ndrivers/usb/dwc3/core.c:798:40: warning: incorrect type in argument 1 (different address spaces)\ndrivers/usb/dwc3/core.c:798:40: expected struct dwc3 *dwc\ndrivers/usb/dwc3/core.c:798:40: got void [noderef] __iomem *regs"
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:53:54.541Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/41a4e80d5af04855e68ac88f5e2cd07fa67287f8"
},
{
"url": "https://git.kernel.org/stable/c/4349e487a1149ff33b65d53427b8aca57f2e4578"
},
{
"url": "https://git.kernel.org/stable/c/e0f844d9d74200d311c6438a0f04270834ba5365"
}
],
"title": "usb: dwc3: fix dwc3_readl() and dwc3_writel() calls in dwc3_ulpi_setup()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64349",
"datePublished": "2026-07-25T08:50:09.647Z",
"dateReserved": "2026-07-19T15:36:31.782Z",
"dateUpdated": "2026-08-17T04:53:54.541Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64348 (GCVE-0-2026-64348)
Vulnerability from nvd – Published: 2026-07-25 08:50 – Updated: 2026-08-17 04:53
VLAI
EPSS
VEX
Title
usb: free iso schedules on failed submit
Summary
In the Linux kernel, the following vulnerability has been resolved:
usb: free iso schedules on failed submit
EHCI and FOTG210 isochronous submits build an ehci_iso_sched before
linking the URB to the endpoint queue, and keep the staged schedule in
urb->hcpriv until iso_stream_schedule() and the link helpers consume it.
If the controller is no longer accessible, or usb_hcd_link_urb_to_ep()
fails, submit jumps to done_not_linked before that handoff happens and
leaks the staged schedule still attached to urb->hcpriv.
Free the staged schedule from done_not_linked when submit fails before
the URB is linked and clear urb->hcpriv after the free.
The bug was first flagged by an experimental analysis tool we are
developing for kernel memory-management bugs while analyzing
v6.13-rc1. The tool is still under development and is not yet publicly
available. Manual inspection confirms that the bug is still
present in v7.1.1.
An x86_64 allyesconfig build showed no new warnings. As we do not have an
EHCI host controller with a USB isochronous device to test with, no
runtime testing was able to be performed.
Severity
No CVSS data available.
Assigner
References
6 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
8de98402652c01839ae321be6cb3054cf5735d83 , < b0d00d077f9738d215af9b50c74dffab7a1de19f
(git)
Affected: 8de98402652c01839ae321be6cb3054cf5735d83 , < be5004395dfd0b6ec310db359f887fa396fd0dd2 (git) Affected: 8de98402652c01839ae321be6cb3054cf5735d83 , < 8890699eea19027ef6e4f9cbcf27cba5e789793f (git) Affected: 8de98402652c01839ae321be6cb3054cf5735d83 , < 6bc17a78a05671d303820224fb37ca339c1dc2cb (git) Affected: 8de98402652c01839ae321be6cb3054cf5735d83 , < 4bb88aee6b868cbf73bf453f62497802f5fe4769 (git) Affected: 8de98402652c01839ae321be6cb3054cf5735d83 , < b9399d25fbb34a05bbe76eeedd730f62ff2670e9 (git) |
|
| Linux | Linux |
Affected:
2.6.15
Unaffected: 0 , < 2.6.15 (semver) Unaffected: 5.10.261 , ≤ 5.10.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.96 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/usb/fotg210/fotg210-hcd.c",
"drivers/usb/host/ehci-sched.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "b0d00d077f9738d215af9b50c74dffab7a1de19f",
"status": "affected",
"version": "8de98402652c01839ae321be6cb3054cf5735d83",
"versionType": "git"
},
{
"lessThan": "be5004395dfd0b6ec310db359f887fa396fd0dd2",
"status": "affected",
"version": "8de98402652c01839ae321be6cb3054cf5735d83",
"versionType": "git"
},
{
"lessThan": "8890699eea19027ef6e4f9cbcf27cba5e789793f",
"status": "affected",
"version": "8de98402652c01839ae321be6cb3054cf5735d83",
"versionType": "git"
},
{
"lessThan": "6bc17a78a05671d303820224fb37ca339c1dc2cb",
"status": "affected",
"version": "8de98402652c01839ae321be6cb3054cf5735d83",
"versionType": "git"
},
{
"lessThan": "4bb88aee6b868cbf73bf453f62497802f5fe4769",
"status": "affected",
"version": "8de98402652c01839ae321be6cb3054cf5735d83",
"versionType": "git"
},
{
"lessThan": "b9399d25fbb34a05bbe76eeedd730f62ff2670e9",
"status": "affected",
"version": "8de98402652c01839ae321be6cb3054cf5735d83",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/usb/fotg210/fotg210-hcd.c",
"drivers/usb/host/ehci-sched.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.15"
},
{
"lessThan": "2.6.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "2.6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "2.6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "2.6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "2.6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "2.6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: free iso schedules on failed submit\n\nEHCI and FOTG210 isochronous submits build an ehci_iso_sched before\nlinking the URB to the endpoint queue, and keep the staged schedule in\nurb-\u003ehcpriv until iso_stream_schedule() and the link helpers consume it.\nIf the controller is no longer accessible, or usb_hcd_link_urb_to_ep()\nfails, submit jumps to done_not_linked before that handoff happens and\nleaks the staged schedule still attached to urb-\u003ehcpriv.\n\nFree the staged schedule from done_not_linked when submit fails before\nthe URB is linked and clear urb-\u003ehcpriv after the free.\n\nThe bug was first flagged by an experimental analysis tool we are\ndeveloping for kernel memory-management bugs while analyzing\nv6.13-rc1. The tool is still under development and is not yet publicly\navailable. Manual inspection confirms that the bug is still\npresent in v7.1.1.\n\nAn x86_64 allyesconfig build showed no new warnings. As we do not have an\nEHCI host controller with a USB isochronous device to test with, no\nruntime testing was able to be performed."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:53:53.432Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/b0d00d077f9738d215af9b50c74dffab7a1de19f"
},
{
"url": "https://git.kernel.org/stable/c/be5004395dfd0b6ec310db359f887fa396fd0dd2"
},
{
"url": "https://git.kernel.org/stable/c/8890699eea19027ef6e4f9cbcf27cba5e789793f"
},
{
"url": "https://git.kernel.org/stable/c/6bc17a78a05671d303820224fb37ca339c1dc2cb"
},
{
"url": "https://git.kernel.org/stable/c/4bb88aee6b868cbf73bf453f62497802f5fe4769"
},
{
"url": "https://git.kernel.org/stable/c/b9399d25fbb34a05bbe76eeedd730f62ff2670e9"
}
],
"title": "usb: free iso schedules on failed submit",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64348",
"datePublished": "2026-07-25T08:50:08.983Z",
"dateReserved": "2026-07-19T15:36:31.782Z",
"dateUpdated": "2026-08-17T04:53:53.432Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64347 (GCVE-0-2026-64347)
Vulnerability from nvd – Published: 2026-07-25 08:50 – Updated: 2026-08-17 04:53
VLAI
EPSS
VEX
Title
usb: gadget: composite: fix dead empty check in the USB_DT_OTG handler
Summary
In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: composite: fix dead empty check in the USB_DT_OTG handler
The OTG branch of composite_setup() falls back to the first
configuration when none is selected:
if (cdev->config)
config = cdev->config;
else
config = list_first_entry(&cdev->configs,
struct usb_configuration, list);
if (!config)
goto done;
...
memcpy(req->buf, config->descriptors[0], value);
list_first_entry() never returns NULL. On an empty list it returns
container_of() of the list head. So the "if (!config)" check is dead.
When cdev->configs is empty, config points at the head inside struct
usb_composite_dev. config->descriptors[0] reads whatever sits at that
offset. The memcpy copies up to w_length bytes of it into the response
buffer.
cdev->configs can be empty in two cases. One is a teardown race on
gadget unbind with a control transfer in flight. The other is a driver
that sets is_otg before it adds a config. A reproducer that holds
cdev->configs empty triggers a KASAN fault in this branch.
Use list_first_entry_or_null() so the existing check does its job.
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
53e6242db8d60da0587d36951cc9434d1a1c21dd , < 2454264b2ab4cf0055c0bfd39e79f830452bd0db
(git)
Affected: 53e6242db8d60da0587d36951cc9434d1a1c21dd , < d3e72cfef2e38bd588055739a8100d14f9773b17 (git) Affected: 53e6242db8d60da0587d36951cc9434d1a1c21dd , < 8ac463fe6c0f85bdb1ce8c30e8c9e060802e4483 (git) Affected: 53e6242db8d60da0587d36951cc9434d1a1c21dd , < 56add2b9b2e89ec61c0761165d758f73004fdfdf (git) Affected: 53e6242db8d60da0587d36951cc9434d1a1c21dd , < 91b3ecd34b60f950c50c560974945b6596a6f207 (git) Affected: 53e6242db8d60da0587d36951cc9434d1a1c21dd , < 01feaf024f29618d5ffa7ab0fd858e0579dcbf7b (git) Affected: 53e6242db8d60da0587d36951cc9434d1a1c21dd , < fcb21bf747640c9d6bd1eda9da85420f076d59c1 (git) Affected: 53e6242db8d60da0587d36951cc9434d1a1c21dd , < f8f680609c2b3ab795ffcd6f21585b6dfc46d395 (git) |
|
| Linux | Linux |
Affected:
4.3
Unaffected: 0 , < 4.3 (semver) Unaffected: 5.10.261 , ≤ 5.10.* (semver) Unaffected: 5.15.212 , ≤ 5.15.* (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.96 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/usb/gadget/composite.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "2454264b2ab4cf0055c0bfd39e79f830452bd0db",
"status": "affected",
"version": "53e6242db8d60da0587d36951cc9434d1a1c21dd",
"versionType": "git"
},
{
"lessThan": "d3e72cfef2e38bd588055739a8100d14f9773b17",
"status": "affected",
"version": "53e6242db8d60da0587d36951cc9434d1a1c21dd",
"versionType": "git"
},
{
"lessThan": "8ac463fe6c0f85bdb1ce8c30e8c9e060802e4483",
"status": "affected",
"version": "53e6242db8d60da0587d36951cc9434d1a1c21dd",
"versionType": "git"
},
{
"lessThan": "56add2b9b2e89ec61c0761165d758f73004fdfdf",
"status": "affected",
"version": "53e6242db8d60da0587d36951cc9434d1a1c21dd",
"versionType": "git"
},
{
"lessThan": "91b3ecd34b60f950c50c560974945b6596a6f207",
"status": "affected",
"version": "53e6242db8d60da0587d36951cc9434d1a1c21dd",
"versionType": "git"
},
{
"lessThan": "01feaf024f29618d5ffa7ab0fd858e0579dcbf7b",
"status": "affected",
"version": "53e6242db8d60da0587d36951cc9434d1a1c21dd",
"versionType": "git"
},
{
"lessThan": "fcb21bf747640c9d6bd1eda9da85420f076d59c1",
"status": "affected",
"version": "53e6242db8d60da0587d36951cc9434d1a1c21dd",
"versionType": "git"
},
{
"lessThan": "f8f680609c2b3ab795ffcd6f21585b6dfc46d395",
"status": "affected",
"version": "53e6242db8d60da0587d36951cc9434d1a1c21dd",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/usb/gadget/composite.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.3"
},
{
"lessThan": "4.3",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "4.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "4.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "4.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "4.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "4.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "4.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "4.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: composite: fix dead empty check in the USB_DT_OTG handler\n\nThe OTG branch of composite_setup() falls back to the first\nconfiguration when none is selected:\n\n\tif (cdev-\u003econfig)\n\t\tconfig = cdev-\u003econfig;\n\telse\n\t\tconfig = list_first_entry(\u0026cdev-\u003econfigs,\n\t\t\t\t\t struct usb_configuration, list);\n\tif (!config)\n\t\tgoto done;\n\t...\n\tmemcpy(req-\u003ebuf, config-\u003edescriptors[0], value);\n\nlist_first_entry() never returns NULL. On an empty list it returns\ncontainer_of() of the list head. So the \"if (!config)\" check is dead.\n\nWhen cdev-\u003econfigs is empty, config points at the head inside struct\nusb_composite_dev. config-\u003edescriptors[0] reads whatever sits at that\noffset. The memcpy copies up to w_length bytes of it into the response\nbuffer.\n\ncdev-\u003econfigs can be empty in two cases. One is a teardown race on\ngadget unbind with a control transfer in flight. The other is a driver\nthat sets is_otg before it adds a config. A reproducer that holds\ncdev-\u003econfigs empty triggers a KASAN fault in this branch.\n\nUse list_first_entry_or_null() so the existing check does its job."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:53:52.339Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/2454264b2ab4cf0055c0bfd39e79f830452bd0db"
},
{
"url": "https://git.kernel.org/stable/c/d3e72cfef2e38bd588055739a8100d14f9773b17"
},
{
"url": "https://git.kernel.org/stable/c/8ac463fe6c0f85bdb1ce8c30e8c9e060802e4483"
},
{
"url": "https://git.kernel.org/stable/c/56add2b9b2e89ec61c0761165d758f73004fdfdf"
},
{
"url": "https://git.kernel.org/stable/c/91b3ecd34b60f950c50c560974945b6596a6f207"
},
{
"url": "https://git.kernel.org/stable/c/01feaf024f29618d5ffa7ab0fd858e0579dcbf7b"
},
{
"url": "https://git.kernel.org/stable/c/fcb21bf747640c9d6bd1eda9da85420f076d59c1"
},
{
"url": "https://git.kernel.org/stable/c/f8f680609c2b3ab795ffcd6f21585b6dfc46d395"
}
],
"title": "usb: gadget: composite: fix dead empty check in the USB_DT_OTG handler",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64347",
"datePublished": "2026-07-25T08:50:08.338Z",
"dateReserved": "2026-07-19T15:36:31.782Z",
"dateUpdated": "2026-08-17T04:53:52.339Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64346 (GCVE-0-2026-64346)
Vulnerability from nvd – Published: 2026-07-25 08:50 – Updated: 2026-08-17 04:53
VLAI
EPSS
VEX
Title
usb: gadget: udc: Fix use-after-free in gadget_match_driver
Summary
In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: udc: Fix use-after-free in gadget_match_driver
The udc structure acts as the management structure for the gadget,
but their lifecycles are decoupled. A race condition exists where
usb_del_gadget() frees the udc memory (e.g., via mode-switch work)
while gadget_match_driver() concurrently accesses the freed udc memory
(e.g., via configfs), causing a Use-After-Free (UAF) that triggers a
NULL pointer dereference when the freed memory is zeroed:
[39430.908615][ T1171] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000
[39430.911397][ T1171] pc : __pi_strcmp+0x20/0x140
[39430.911441][ T1171] lr : gadget_match_driver+0x34/0x60
...
[39430.911890][ T1171] usb_gadget_register_driver_owner+0x50/0xf8
[39430.911910][ T1171] gadget_dev_desc_UDC_store+0xf4/0x140
[39430.931308][ T1171] configfs_write_iter+0xec/0x134
[39430.957058][ T1171] Workqueue: events_freezable __dwc3_set_mode
[39430.957287][ T1171] dwc3_gadget_exit+0x34/0x8c
[39430.957304][ T1171] __dwc3_set_mode+0xc0/0x664
Fix this by ensuring the udc structure remains allocated until the
gadget is released. To achieve this, introduce a new
usb_gadget_release() routine to the core. When the gadget is added,
usb_add_gadget() stores the gadget's release routine in the udc
structure and takes a reference to the udc. When the gadget is
released, usb_gadget_release() drops the reference to the udc and
then calls the gadget's release routine.
Severity
No CVSS data available.
Assigner
References
6 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
fc274c1e997314bf47f6a62c79b5d7e554ed59c4 , < 50eeb8e8a4f389efc91b93cff14a683e714ec194
(git)
Affected: fc274c1e997314bf47f6a62c79b5d7e554ed59c4 , < 7a5214dae906d9f58e07bc4995e8181ee74439f4 (git) Affected: fc274c1e997314bf47f6a62c79b5d7e554ed59c4 , < d026f71df141c9b064ff32a78af5391a31ef75c2 (git) Affected: fc274c1e997314bf47f6a62c79b5d7e554ed59c4 , < b52476a83d9e12df00765359d728a875b128bef1 (git) Affected: fc274c1e997314bf47f6a62c79b5d7e554ed59c4 , < 54fa390aae393eb130f307a85562e3001cc39a52 (git) Affected: fc274c1e997314bf47f6a62c79b5d7e554ed59c4 , < 67e511d2989eb1c8c588b599ce2fcc6bb8e6f7ea (git) |
|
| Linux | Linux |
Affected:
5.19
Unaffected: 0 , < 5.19 (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.96 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/usb/gadget/udc/core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "50eeb8e8a4f389efc91b93cff14a683e714ec194",
"status": "affected",
"version": "fc274c1e997314bf47f6a62c79b5d7e554ed59c4",
"versionType": "git"
},
{
"lessThan": "7a5214dae906d9f58e07bc4995e8181ee74439f4",
"status": "affected",
"version": "fc274c1e997314bf47f6a62c79b5d7e554ed59c4",
"versionType": "git"
},
{
"lessThan": "d026f71df141c9b064ff32a78af5391a31ef75c2",
"status": "affected",
"version": "fc274c1e997314bf47f6a62c79b5d7e554ed59c4",
"versionType": "git"
},
{
"lessThan": "b52476a83d9e12df00765359d728a875b128bef1",
"status": "affected",
"version": "fc274c1e997314bf47f6a62c79b5d7e554ed59c4",
"versionType": "git"
},
{
"lessThan": "54fa390aae393eb130f307a85562e3001cc39a52",
"status": "affected",
"version": "fc274c1e997314bf47f6a62c79b5d7e554ed59c4",
"versionType": "git"
},
{
"lessThan": "67e511d2989eb1c8c588b599ce2fcc6bb8e6f7ea",
"status": "affected",
"version": "fc274c1e997314bf47f6a62c79b5d7e554ed59c4",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/usb/gadget/udc/core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.19"
},
{
"lessThan": "5.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: udc: Fix use-after-free in gadget_match_driver\n\nThe udc structure acts as the management structure for the gadget,\nbut their lifecycles are decoupled. A race condition exists where\nusb_del_gadget() frees the udc memory (e.g., via mode-switch work)\nwhile gadget_match_driver() concurrently accesses the freed udc memory\n(e.g., via configfs), causing a Use-After-Free (UAF) that triggers a\nNULL pointer dereference when the freed memory is zeroed:\n\n[39430.908615][ T1171] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000\n[39430.911397][ T1171] pc : __pi_strcmp+0x20/0x140\n[39430.911441][ T1171] lr : gadget_match_driver+0x34/0x60\n...\n[39430.911890][ T1171] usb_gadget_register_driver_owner+0x50/0xf8\n[39430.911910][ T1171] gadget_dev_desc_UDC_store+0xf4/0x140\n[39430.931308][ T1171] configfs_write_iter+0xec/0x134\n\n[39430.957058][ T1171] Workqueue: events_freezable __dwc3_set_mode\n[39430.957287][ T1171] dwc3_gadget_exit+0x34/0x8c\n[39430.957304][ T1171] __dwc3_set_mode+0xc0/0x664\n\nFix this by ensuring the udc structure remains allocated until the\ngadget is released. To achieve this, introduce a new\nusb_gadget_release() routine to the core. When the gadget is added,\nusb_add_gadget() stores the gadget\u0027s release routine in the udc\nstructure and takes a reference to the udc. When the gadget is\nreleased, usb_gadget_release() drops the reference to the udc and\nthen calls the gadget\u0027s release routine."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:53:51.249Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/50eeb8e8a4f389efc91b93cff14a683e714ec194"
},
{
"url": "https://git.kernel.org/stable/c/7a5214dae906d9f58e07bc4995e8181ee74439f4"
},
{
"url": "https://git.kernel.org/stable/c/d026f71df141c9b064ff32a78af5391a31ef75c2"
},
{
"url": "https://git.kernel.org/stable/c/b52476a83d9e12df00765359d728a875b128bef1"
},
{
"url": "https://git.kernel.org/stable/c/54fa390aae393eb130f307a85562e3001cc39a52"
},
{
"url": "https://git.kernel.org/stable/c/67e511d2989eb1c8c588b599ce2fcc6bb8e6f7ea"
}
],
"title": "usb: gadget: udc: Fix use-after-free in gadget_match_driver",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64346",
"datePublished": "2026-07-25T08:50:07.680Z",
"dateReserved": "2026-07-19T15:36:31.782Z",
"dateUpdated": "2026-08-17T04:53:51.249Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64345 (GCVE-0-2026-64345)
Vulnerability from nvd – Published: 2026-07-25 08:50 – Updated: 2026-08-17 04:53
VLAI
EPSS
VEX
Title
usb: gadget: f_printer: take kref only for successful open
Summary
In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: f_printer: take kref only for successful open
printer_open() returns -EBUSY when the character device is already
open, but it increments dev->kref regardless of the return value. VFS
does not call ->release() for a failed open, so every rejected second
open permanently leaks one reference.
Move kref_get() into the successful-open branch.
Severity
No CVSS data available.
Assigner
References
6 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
e8d5f92b8d30bb4ade76494490c3c065e12411b1 , < 94ec20d97aa51547965a539f660a1fe79c6929a3
(git)
Affected: e8d5f92b8d30bb4ade76494490c3c065e12411b1 , < 75c0ad13e136961328253742501b4efc3988a587 (git) Affected: e8d5f92b8d30bb4ade76494490c3c065e12411b1 , < bf20c94fa6aaff945f0ae3a23f3212cd299f28d9 (git) Affected: e8d5f92b8d30bb4ade76494490c3c065e12411b1 , < 8a5eba992c862b0c94411eecf9b7121e8636db38 (git) Affected: e8d5f92b8d30bb4ade76494490c3c065e12411b1 , < 7f1f24c367938c5537e2308bf9a965f051d14774 (git) Affected: e8d5f92b8d30bb4ade76494490c3c065e12411b1 , < 30adce93d5c4a5a1ec29d9249e3fdfcc391d406b (git) Affected: 25c95c6bd4dc50a3c20de0fa7f450ea02b2320fc (git) Affected: 4a47581cf010dc351d8069978080fdb000c0776d (git) Affected: d9fe88b2a38dc700bf5bd3a09c7cd11bbc248367 (git) Affected: cedb0187b8ba929c3f76f28e6bc25804d65f8a54 (git) Affected: e9e791f5c39ab30e374a3b1a9c25ca7ff24988f3 (git) Affected: 34f026263889e2827e04acdc3a0eb9ecbd191ef0 (git) Affected: 5f845e5d18d151230476cf90aa46449f69ba2ef1 (git) Affected: 4.4.241 , < 4.5 (semver) Affected: 4.9.241 , < 4.10 (semver) Affected: 4.14.203 , < 4.15 (semver) Affected: 4.19.154 , < 4.20 (semver) Affected: 5.4.73 , < 5.5 (semver) Affected: 5.8.17 , < 5.9 (semver) Affected: 5.9.2 , < 5.10 (semver) |
|
| Linux | Linux |
Affected:
5.10
Unaffected: 0 , < 5.10 (semver) Unaffected: 5.10.261 , ≤ 5.10.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.96 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/usb/gadget/function/f_printer.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "94ec20d97aa51547965a539f660a1fe79c6929a3",
"status": "affected",
"version": "e8d5f92b8d30bb4ade76494490c3c065e12411b1",
"versionType": "git"
},
{
"lessThan": "75c0ad13e136961328253742501b4efc3988a587",
"status": "affected",
"version": "e8d5f92b8d30bb4ade76494490c3c065e12411b1",
"versionType": "git"
},
{
"lessThan": "bf20c94fa6aaff945f0ae3a23f3212cd299f28d9",
"status": "affected",
"version": "e8d5f92b8d30bb4ade76494490c3c065e12411b1",
"versionType": "git"
},
{
"lessThan": "8a5eba992c862b0c94411eecf9b7121e8636db38",
"status": "affected",
"version": "e8d5f92b8d30bb4ade76494490c3c065e12411b1",
"versionType": "git"
},
{
"lessThan": "7f1f24c367938c5537e2308bf9a965f051d14774",
"status": "affected",
"version": "e8d5f92b8d30bb4ade76494490c3c065e12411b1",
"versionType": "git"
},
{
"lessThan": "30adce93d5c4a5a1ec29d9249e3fdfcc391d406b",
"status": "affected",
"version": "e8d5f92b8d30bb4ade76494490c3c065e12411b1",
"versionType": "git"
},
{
"status": "affected",
"version": "25c95c6bd4dc50a3c20de0fa7f450ea02b2320fc",
"versionType": "git"
},
{
"status": "affected",
"version": "4a47581cf010dc351d8069978080fdb000c0776d",
"versionType": "git"
},
{
"status": "affected",
"version": "d9fe88b2a38dc700bf5bd3a09c7cd11bbc248367",
"versionType": "git"
},
{
"status": "affected",
"version": "cedb0187b8ba929c3f76f28e6bc25804d65f8a54",
"versionType": "git"
},
{
"status": "affected",
"version": "e9e791f5c39ab30e374a3b1a9c25ca7ff24988f3",
"versionType": "git"
},
{
"status": "affected",
"version": "34f026263889e2827e04acdc3a0eb9ecbd191ef0",
"versionType": "git"
},
{
"status": "affected",
"version": "5f845e5d18d151230476cf90aa46449f69ba2ef1",
"versionType": "git"
},
{
"lessThan": "4.5",
"status": "affected",
"version": "4.4.241",
"versionType": "semver"
},
{
"lessThan": "4.10",
"status": "affected",
"version": "4.9.241",
"versionType": "semver"
},
{
"lessThan": "4.15",
"status": "affected",
"version": "4.14.203",
"versionType": "semver"
},
{
"lessThan": "4.20",
"status": "affected",
"version": "4.19.154",
"versionType": "semver"
},
{
"lessThan": "5.5",
"status": "affected",
"version": "5.4.73",
"versionType": "semver"
},
{
"lessThan": "5.9",
"status": "affected",
"version": "5.8.17",
"versionType": "semver"
},
{
"lessThan": "5.10",
"status": "affected",
"version": "5.9.2",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/usb/gadget/function/f_printer.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.10"
},
{
"lessThan": "5.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.4.241",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.9.241",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.14.203",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.19.154",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.4.73",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.8.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.9.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: f_printer: take kref only for successful open\n\nprinter_open() returns -EBUSY when the character device is already\nopen, but it increments dev-\u003ekref regardless of the return value. VFS\ndoes not call -\u003erelease() for a failed open, so every rejected second\nopen permanently leaks one reference.\n\nMove kref_get() into the successful-open branch."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:53:49.464Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/94ec20d97aa51547965a539f660a1fe79c6929a3"
},
{
"url": "https://git.kernel.org/stable/c/75c0ad13e136961328253742501b4efc3988a587"
},
{
"url": "https://git.kernel.org/stable/c/bf20c94fa6aaff945f0ae3a23f3212cd299f28d9"
},
{
"url": "https://git.kernel.org/stable/c/8a5eba992c862b0c94411eecf9b7121e8636db38"
},
{
"url": "https://git.kernel.org/stable/c/7f1f24c367938c5537e2308bf9a965f051d14774"
},
{
"url": "https://git.kernel.org/stable/c/30adce93d5c4a5a1ec29d9249e3fdfcc391d406b"
}
],
"title": "usb: gadget: f_printer: take kref only for successful open",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64345",
"datePublished": "2026-07-25T08:50:07.069Z",
"dateReserved": "2026-07-19T15:36:31.781Z",
"dateUpdated": "2026-08-17T04:53:49.464Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64344 (GCVE-0-2026-64344)
Vulnerability from nvd – Published: 2026-07-25 08:50 – Updated: 2026-08-17 04:53
VLAI
EPSS
VEX
Title
USB: idmouse: fix use-after-free on disconnect race
Summary
In the Linux kernel, the following vulnerability has been resolved:
USB: idmouse: fix use-after-free on disconnect race
mutex_unlock() may access the mutex structure after releasing the lock
and therefore cannot be used to manage lifetime of objects directly
(unlike spinlocks and refcounts). [1][2]
Use a kref to release the driver data to avoid use-after-free in
mutex_unlock() when release() races with disconnect().
[1] a51749ab34d9 ("locking/mutex: Document that mutex_unlock() is
non-atomic")
[2] 2b9d9e0a9ba0 ("locking/mutex: Clarify that mutex_unlock(), and most
other sleeping locks, can still use the lock object
after it's unlocked")
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
54d2bc068fd21bcb096660938bce7c7265613a24 , < 31e75fed8f90cfea9f8285e7ed135b0e452bf872
(git)
Affected: 54d2bc068fd21bcb096660938bce7c7265613a24 , < 8d53b14ad4ccbff6d306b3a39c812303f4a87d41 (git) Affected: 54d2bc068fd21bcb096660938bce7c7265613a24 , < f62622e947f82a3854a8502d09492ffbdeb252b4 (git) Affected: 54d2bc068fd21bcb096660938bce7c7265613a24 , < 60fc5ef4ecea3e3d1fe556cecf53ddd13096ef09 (git) Affected: 54d2bc068fd21bcb096660938bce7c7265613a24 , < d0f61acb51a8c8f3fd41c303ddb7770cd83e7ed4 (git) Affected: 54d2bc068fd21bcb096660938bce7c7265613a24 , < 54c2b7356b4aeea467f9fb13b85e9e036bc428cb (git) Affected: 54d2bc068fd21bcb096660938bce7c7265613a24 , < e88cff5fbaa629f3cab45c8b46f395d62c2eb515 (git) Affected: 54d2bc068fd21bcb096660938bce7c7265613a24 , < ff002c153f9722caece3983cc23dc4d9d4652cb4 (git) |
|
| Linux | Linux |
Affected:
2.6.24
Unaffected: 0 , < 2.6.24 (semver) Unaffected: 5.10.261 , ≤ 5.10.* (semver) Unaffected: 5.15.212 , ≤ 5.15.* (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.96 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/usb/misc/idmouse.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "31e75fed8f90cfea9f8285e7ed135b0e452bf872",
"status": "affected",
"version": "54d2bc068fd21bcb096660938bce7c7265613a24",
"versionType": "git"
},
{
"lessThan": "8d53b14ad4ccbff6d306b3a39c812303f4a87d41",
"status": "affected",
"version": "54d2bc068fd21bcb096660938bce7c7265613a24",
"versionType": "git"
},
{
"lessThan": "f62622e947f82a3854a8502d09492ffbdeb252b4",
"status": "affected",
"version": "54d2bc068fd21bcb096660938bce7c7265613a24",
"versionType": "git"
},
{
"lessThan": "60fc5ef4ecea3e3d1fe556cecf53ddd13096ef09",
"status": "affected",
"version": "54d2bc068fd21bcb096660938bce7c7265613a24",
"versionType": "git"
},
{
"lessThan": "d0f61acb51a8c8f3fd41c303ddb7770cd83e7ed4",
"status": "affected",
"version": "54d2bc068fd21bcb096660938bce7c7265613a24",
"versionType": "git"
},
{
"lessThan": "54c2b7356b4aeea467f9fb13b85e9e036bc428cb",
"status": "affected",
"version": "54d2bc068fd21bcb096660938bce7c7265613a24",
"versionType": "git"
},
{
"lessThan": "e88cff5fbaa629f3cab45c8b46f395d62c2eb515",
"status": "affected",
"version": "54d2bc068fd21bcb096660938bce7c7265613a24",
"versionType": "git"
},
{
"lessThan": "ff002c153f9722caece3983cc23dc4d9d4652cb4",
"status": "affected",
"version": "54d2bc068fd21bcb096660938bce7c7265613a24",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/usb/misc/idmouse.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.24"
},
{
"lessThan": "2.6.24",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.24",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: idmouse: fix use-after-free on disconnect race\n\nmutex_unlock() may access the mutex structure after releasing the lock\nand therefore cannot be used to manage lifetime of objects directly\n(unlike spinlocks and refcounts). [1][2]\n\nUse a kref to release the driver data to avoid use-after-free in\nmutex_unlock() when release() races with disconnect().\n\n[1] a51749ab34d9 (\"locking/mutex: Document that mutex_unlock() is\n non-atomic\")\n[2] 2b9d9e0a9ba0 (\"locking/mutex: Clarify that mutex_unlock(), and most\n other sleeping locks, can still use the lock object\n after it\u0027s unlocked\")"
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:53:48.283Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/31e75fed8f90cfea9f8285e7ed135b0e452bf872"
},
{
"url": "https://git.kernel.org/stable/c/8d53b14ad4ccbff6d306b3a39c812303f4a87d41"
},
{
"url": "https://git.kernel.org/stable/c/f62622e947f82a3854a8502d09492ffbdeb252b4"
},
{
"url": "https://git.kernel.org/stable/c/60fc5ef4ecea3e3d1fe556cecf53ddd13096ef09"
},
{
"url": "https://git.kernel.org/stable/c/d0f61acb51a8c8f3fd41c303ddb7770cd83e7ed4"
},
{
"url": "https://git.kernel.org/stable/c/54c2b7356b4aeea467f9fb13b85e9e036bc428cb"
},
{
"url": "https://git.kernel.org/stable/c/e88cff5fbaa629f3cab45c8b46f395d62c2eb515"
},
{
"url": "https://git.kernel.org/stable/c/ff002c153f9722caece3983cc23dc4d9d4652cb4"
}
],
"title": "USB: idmouse: fix use-after-free on disconnect race",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64344",
"datePublished": "2026-07-25T08:50:06.461Z",
"dateReserved": "2026-07-19T15:36:31.781Z",
"dateUpdated": "2026-08-17T04:53:48.283Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64343 (GCVE-0-2026-64343)
Vulnerability from nvd – Published: 2026-07-25 08:50 – Updated: 2026-08-17 04:53
VLAI
EPSS
VEX
Title
USB: ldusb: fix use-after-free on disconnect race
Summary
In the Linux kernel, the following vulnerability has been resolved:
USB: ldusb: fix use-after-free on disconnect race
mutex_unlock() may access the mutex structure after releasing the lock
and therefore cannot be used to manage lifetime of objects directly
(unlike spinlocks and refcounts). [1][2]
Use a kref to release the driver data to avoid use-after-free in
mutex_unlock() when release() races with disconnect().
[1] a51749ab34d9 ("locking/mutex: Document that mutex_unlock() is
non-atomic")
[2] 2b9d9e0a9ba0 ("locking/mutex: Clarify that mutex_unlock(), and most
other sleeping locks, can still use the lock object
after it's unlocked")
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
ce0d7d3f575fc1ba6a89c3c651e710355590daff , < fc55923a972e715f9a27187b47d4920709e23d85
(git)
Affected: ce0d7d3f575fc1ba6a89c3c651e710355590daff , < e5a9bdce4bfd3e2226b5f3df5fb8385d6935ee69 (git) Affected: ce0d7d3f575fc1ba6a89c3c651e710355590daff , < af59829e67e11ba2511a9f8e4b9111afc7d1f550 (git) Affected: ce0d7d3f575fc1ba6a89c3c651e710355590daff , < 02ca08fff74cf9b0a3c4d2cacde1c6edeeb95bb4 (git) Affected: ce0d7d3f575fc1ba6a89c3c651e710355590daff , < d8f69404e1d671326f86d378b9f5bfbd56490e9d (git) Affected: ce0d7d3f575fc1ba6a89c3c651e710355590daff , < 2107a4fc8ff1cf1d52f416c1e5cc8e97413a5915 (git) Affected: ce0d7d3f575fc1ba6a89c3c651e710355590daff , < a3e794136ab5e3ad1e7019175a4b837aec86db4b (git) Affected: ce0d7d3f575fc1ba6a89c3c651e710355590daff , < 19bdfc7b3c179331eafa423d87e1336f43bbfeb8 (git) |
|
| Linux | Linux |
Affected:
2.6.26
Unaffected: 0 , < 2.6.26 (semver) Unaffected: 5.10.261 , ≤ 5.10.* (semver) Unaffected: 5.15.212 , ≤ 5.15.* (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.96 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/usb/misc/ldusb.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "fc55923a972e715f9a27187b47d4920709e23d85",
"status": "affected",
"version": "ce0d7d3f575fc1ba6a89c3c651e710355590daff",
"versionType": "git"
},
{
"lessThan": "e5a9bdce4bfd3e2226b5f3df5fb8385d6935ee69",
"status": "affected",
"version": "ce0d7d3f575fc1ba6a89c3c651e710355590daff",
"versionType": "git"
},
{
"lessThan": "af59829e67e11ba2511a9f8e4b9111afc7d1f550",
"status": "affected",
"version": "ce0d7d3f575fc1ba6a89c3c651e710355590daff",
"versionType": "git"
},
{
"lessThan": "02ca08fff74cf9b0a3c4d2cacde1c6edeeb95bb4",
"status": "affected",
"version": "ce0d7d3f575fc1ba6a89c3c651e710355590daff",
"versionType": "git"
},
{
"lessThan": "d8f69404e1d671326f86d378b9f5bfbd56490e9d",
"status": "affected",
"version": "ce0d7d3f575fc1ba6a89c3c651e710355590daff",
"versionType": "git"
},
{
"lessThan": "2107a4fc8ff1cf1d52f416c1e5cc8e97413a5915",
"status": "affected",
"version": "ce0d7d3f575fc1ba6a89c3c651e710355590daff",
"versionType": "git"
},
{
"lessThan": "a3e794136ab5e3ad1e7019175a4b837aec86db4b",
"status": "affected",
"version": "ce0d7d3f575fc1ba6a89c3c651e710355590daff",
"versionType": "git"
},
{
"lessThan": "19bdfc7b3c179331eafa423d87e1336f43bbfeb8",
"status": "affected",
"version": "ce0d7d3f575fc1ba6a89c3c651e710355590daff",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/usb/misc/ldusb.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.26"
},
{
"lessThan": "2.6.26",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.26",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: ldusb: fix use-after-free on disconnect race\n\nmutex_unlock() may access the mutex structure after releasing the lock\nand therefore cannot be used to manage lifetime of objects directly\n(unlike spinlocks and refcounts). [1][2]\n\nUse a kref to release the driver data to avoid use-after-free in\nmutex_unlock() when release() races with disconnect().\n\n[1] a51749ab34d9 (\"locking/mutex: Document that mutex_unlock() is\n non-atomic\")\n[2] 2b9d9e0a9ba0 (\"locking/mutex: Clarify that mutex_unlock(), and most\n other sleeping locks, can still use the lock object\n after it\u0027s unlocked\")"
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:53:47.172Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/fc55923a972e715f9a27187b47d4920709e23d85"
},
{
"url": "https://git.kernel.org/stable/c/e5a9bdce4bfd3e2226b5f3df5fb8385d6935ee69"
},
{
"url": "https://git.kernel.org/stable/c/af59829e67e11ba2511a9f8e4b9111afc7d1f550"
},
{
"url": "https://git.kernel.org/stable/c/02ca08fff74cf9b0a3c4d2cacde1c6edeeb95bb4"
},
{
"url": "https://git.kernel.org/stable/c/d8f69404e1d671326f86d378b9f5bfbd56490e9d"
},
{
"url": "https://git.kernel.org/stable/c/2107a4fc8ff1cf1d52f416c1e5cc8e97413a5915"
},
{
"url": "https://git.kernel.org/stable/c/a3e794136ab5e3ad1e7019175a4b837aec86db4b"
},
{
"url": "https://git.kernel.org/stable/c/19bdfc7b3c179331eafa423d87e1336f43bbfeb8"
}
],
"title": "USB: ldusb: fix use-after-free on disconnect race",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64343",
"datePublished": "2026-07-25T08:50:05.828Z",
"dateReserved": "2026-07-19T15:36:31.781Z",
"dateUpdated": "2026-08-17T04:53:47.172Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64342 (GCVE-0-2026-64342)
Vulnerability from nvd – Published: 2026-07-25 08:50 – Updated: 2026-08-17 04:53
VLAI
EPSS
VEX
Title
USB: iowarrior: fix use-after-free on disconnect
Summary
In the Linux kernel, the following vulnerability has been resolved:
USB: iowarrior: fix use-after-free on disconnect
Submitted write URBs are not stopped on close() and therefore need to be
stopped unconditionally on disconnect() to avoid use-after-free in the
completion handler.
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
946b960d13c15f050a3b848987aaca79f6a459b7 , < d058d377291567b72aea33b017215cbfb383b0ad
(git)
Affected: 946b960d13c15f050a3b848987aaca79f6a459b7 , < a7bbe946ca3a6eeb6f364d5e84b05e02c7c0d595 (git) Affected: 946b960d13c15f050a3b848987aaca79f6a459b7 , < 97ad9337127be04ca0b027c2b01e69302353f404 (git) Affected: 946b960d13c15f050a3b848987aaca79f6a459b7 , < 164398601a7f160bc3df1efa454f983302cef03f (git) Affected: 946b960d13c15f050a3b848987aaca79f6a459b7 , < f328b0e9a0dbd162f5db1b83026b689f2fea2241 (git) Affected: 946b960d13c15f050a3b848987aaca79f6a459b7 , < b748f97aff339e7f08dca9cf38a05b980fb66fea (git) Affected: 946b960d13c15f050a3b848987aaca79f6a459b7 , < e4596816984efc537e7c04c1af0c639394f967f7 (git) Affected: 946b960d13c15f050a3b848987aaca79f6a459b7 , < bc0e4f16c44e50daa0b1ea729934baa3b4815dee (git) |
|
| Linux | Linux |
Affected:
2.6.21
Unaffected: 0 , < 2.6.21 (semver) Unaffected: 5.10.261 , ≤ 5.10.* (semver) Unaffected: 5.15.212 , ≤ 5.15.* (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.96 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/usb/misc/iowarrior.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "d058d377291567b72aea33b017215cbfb383b0ad",
"status": "affected",
"version": "946b960d13c15f050a3b848987aaca79f6a459b7",
"versionType": "git"
},
{
"lessThan": "a7bbe946ca3a6eeb6f364d5e84b05e02c7c0d595",
"status": "affected",
"version": "946b960d13c15f050a3b848987aaca79f6a459b7",
"versionType": "git"
},
{
"lessThan": "97ad9337127be04ca0b027c2b01e69302353f404",
"status": "affected",
"version": "946b960d13c15f050a3b848987aaca79f6a459b7",
"versionType": "git"
},
{
"lessThan": "164398601a7f160bc3df1efa454f983302cef03f",
"status": "affected",
"version": "946b960d13c15f050a3b848987aaca79f6a459b7",
"versionType": "git"
},
{
"lessThan": "f328b0e9a0dbd162f5db1b83026b689f2fea2241",
"status": "affected",
"version": "946b960d13c15f050a3b848987aaca79f6a459b7",
"versionType": "git"
},
{
"lessThan": "b748f97aff339e7f08dca9cf38a05b980fb66fea",
"status": "affected",
"version": "946b960d13c15f050a3b848987aaca79f6a459b7",
"versionType": "git"
},
{
"lessThan": "e4596816984efc537e7c04c1af0c639394f967f7",
"status": "affected",
"version": "946b960d13c15f050a3b848987aaca79f6a459b7",
"versionType": "git"
},
{
"lessThan": "bc0e4f16c44e50daa0b1ea729934baa3b4815dee",
"status": "affected",
"version": "946b960d13c15f050a3b848987aaca79f6a459b7",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/usb/misc/iowarrior.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.21"
},
{
"lessThan": "2.6.21",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "2.6.21",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "2.6.21",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "2.6.21",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "2.6.21",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "2.6.21",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "2.6.21",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "2.6.21",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.21",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: iowarrior: fix use-after-free on disconnect\n\nSubmitted write URBs are not stopped on close() and therefore need to be\nstopped unconditionally on disconnect() to avoid use-after-free in the\ncompletion handler."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:53:46.066Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/d058d377291567b72aea33b017215cbfb383b0ad"
},
{
"url": "https://git.kernel.org/stable/c/a7bbe946ca3a6eeb6f364d5e84b05e02c7c0d595"
},
{
"url": "https://git.kernel.org/stable/c/97ad9337127be04ca0b027c2b01e69302353f404"
},
{
"url": "https://git.kernel.org/stable/c/164398601a7f160bc3df1efa454f983302cef03f"
},
{
"url": "https://git.kernel.org/stable/c/f328b0e9a0dbd162f5db1b83026b689f2fea2241"
},
{
"url": "https://git.kernel.org/stable/c/b748f97aff339e7f08dca9cf38a05b980fb66fea"
},
{
"url": "https://git.kernel.org/stable/c/e4596816984efc537e7c04c1af0c639394f967f7"
},
{
"url": "https://git.kernel.org/stable/c/bc0e4f16c44e50daa0b1ea729934baa3b4815dee"
}
],
"title": "USB: iowarrior: fix use-after-free on disconnect",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64342",
"datePublished": "2026-07-25T08:50:05.169Z",
"dateReserved": "2026-07-19T15:36:31.781Z",
"dateUpdated": "2026-08-17T04:53:46.066Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64341 (GCVE-0-2026-64341)
Vulnerability from nvd – Published: 2026-07-25 08:50 – Updated: 2026-08-17 04:53
VLAI
EPSS
VEX
Title
USB: iowarrior: fix use-after-free on disconnect race
Summary
In the Linux kernel, the following vulnerability has been resolved:
USB: iowarrior: fix use-after-free on disconnect race
mutex_unlock() may access the mutex structure after releasing the lock
and therefore cannot be used to manage lifetime of objects directly
(unlike spinlocks and refcounts). [1][2]
Use a kref to release the driver data to avoid use-after-free in
mutex_unlock() when release() races with disconnect().
[1] a51749ab34d9 ("locking/mutex: Document that mutex_unlock() is non-atomic")
[2] 2b9d9e0a9ba0 ("locking/mutex: Clarify that mutex_unlock(), and most
other sleeping locks, can still use the lock object
after it's unlocked")
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
946b960d13c15f050a3b848987aaca79f6a459b7 , < 3c0a7b29ebb391d5f50b115e86f842b709195b08
(git)
Affected: 946b960d13c15f050a3b848987aaca79f6a459b7 , < 71590982700fdeb39a37a500c877228b0140978e (git) Affected: 946b960d13c15f050a3b848987aaca79f6a459b7 , < c602254ba4c10f60a73cd99d147874f86a3f485c (git) |
|
| Linux | Linux |
Affected:
2.6.21
Unaffected: 0 , < 2.6.21 (semver) Unaffected: 6.12.97 , ≤ 6.12.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/usb/misc/iowarrior.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "3c0a7b29ebb391d5f50b115e86f842b709195b08",
"status": "affected",
"version": "946b960d13c15f050a3b848987aaca79f6a459b7",
"versionType": "git"
},
{
"lessThan": "71590982700fdeb39a37a500c877228b0140978e",
"status": "affected",
"version": "946b960d13c15f050a3b848987aaca79f6a459b7",
"versionType": "git"
},
{
"lessThan": "c602254ba4c10f60a73cd99d147874f86a3f485c",
"status": "affected",
"version": "946b960d13c15f050a3b848987aaca79f6a459b7",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/usb/misc/iowarrior.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.21"
},
{
"lessThan": "2.6.21",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "2.6.21",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "2.6.21",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.21",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: iowarrior: fix use-after-free on disconnect race\n\nmutex_unlock() may access the mutex structure after releasing the lock\nand therefore cannot be used to manage lifetime of objects directly\n(unlike spinlocks and refcounts). [1][2]\n\nUse a kref to release the driver data to avoid use-after-free in\nmutex_unlock() when release() races with disconnect().\n\n[1] a51749ab34d9 (\"locking/mutex: Document that mutex_unlock() is non-atomic\")\n[2] 2b9d9e0a9ba0 (\"locking/mutex: Clarify that mutex_unlock(), and most\n other sleeping locks, can still use the lock object\n after it\u0027s unlocked\")"
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:53:44.970Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/3c0a7b29ebb391d5f50b115e86f842b709195b08"
},
{
"url": "https://git.kernel.org/stable/c/71590982700fdeb39a37a500c877228b0140978e"
},
{
"url": "https://git.kernel.org/stable/c/c602254ba4c10f60a73cd99d147874f86a3f485c"
}
],
"title": "USB: iowarrior: fix use-after-free on disconnect race",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64341",
"datePublished": "2026-07-25T08:50:04.512Z",
"dateReserved": "2026-07-19T15:36:31.781Z",
"dateUpdated": "2026-08-17T04:53:44.970Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64340 (GCVE-0-2026-64340)
Vulnerability from nvd – Published: 2026-07-25 08:50 – Updated: 2026-08-17 04:53
VLAI
EPSS
VEX
Title
USB: legousbtower: fix use-after-free on disconnect race
Summary
In the Linux kernel, the following vulnerability has been resolved:
USB: legousbtower: fix use-after-free on disconnect race
mutex_unlock() may access the mutex structure after releasing the lock
and therefore cannot be used to manage lifetime of objects directly
(unlike spinlocks and refcounts). [1][2]
Use a kref to release the driver data to avoid use-after-free in
mutex_unlock() when release() races with disconnect().
[1] a51749ab34d9 ("locking/mutex: Document that mutex_unlock() is
non-atomic")
[2] 2b9d9e0a9ba0 ("locking/mutex: Clarify that mutex_unlock(), and most
other sleeping locks, can still use the lock object
after it's unlocked")
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
18bcbcfe9ca2308ebffb40068b51803da9315d97 , < 11d069f85851997b4ea0adf242ed9672dc749b8f
(git)
Affected: 18bcbcfe9ca2308ebffb40068b51803da9315d97 , < b4222c05066b252b451f9c8c4730b5b60824ea66 (git) Affected: 18bcbcfe9ca2308ebffb40068b51803da9315d97 , < 6462de75d2e370c7e74dcfb7b4ae79eb5a6a55ee (git) Affected: 18bcbcfe9ca2308ebffb40068b51803da9315d97 , < 0b57e5ddbd89df3bc367463de3d2ca66f99a1a5e (git) Affected: 18bcbcfe9ca2308ebffb40068b51803da9315d97 , < ab2bfd7bec4f134b377ec42f513e90c35db94160 (git) Affected: 18bcbcfe9ca2308ebffb40068b51803da9315d97 , < 766738ecf2b819e54d38763c8d1c8ae6cff14b39 (git) Affected: 18bcbcfe9ca2308ebffb40068b51803da9315d97 , < 9ba62966461a8e3cc593b62c56ec62eb2d80436d (git) Affected: 18bcbcfe9ca2308ebffb40068b51803da9315d97 , < 62fc8eb1b1481051f7bab4aa93d79809053dd09f (git) |
|
| Linux | Linux |
Affected:
2.6.25
Unaffected: 0 , < 2.6.25 (semver) Unaffected: 5.10.261 , ≤ 5.10.* (semver) Unaffected: 5.15.212 , ≤ 5.15.* (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.96 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/usb/misc/legousbtower.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "11d069f85851997b4ea0adf242ed9672dc749b8f",
"status": "affected",
"version": "18bcbcfe9ca2308ebffb40068b51803da9315d97",
"versionType": "git"
},
{
"lessThan": "b4222c05066b252b451f9c8c4730b5b60824ea66",
"status": "affected",
"version": "18bcbcfe9ca2308ebffb40068b51803da9315d97",
"versionType": "git"
},
{
"lessThan": "6462de75d2e370c7e74dcfb7b4ae79eb5a6a55ee",
"status": "affected",
"version": "18bcbcfe9ca2308ebffb40068b51803da9315d97",
"versionType": "git"
},
{
"lessThan": "0b57e5ddbd89df3bc367463de3d2ca66f99a1a5e",
"status": "affected",
"version": "18bcbcfe9ca2308ebffb40068b51803da9315d97",
"versionType": "git"
},
{
"lessThan": "ab2bfd7bec4f134b377ec42f513e90c35db94160",
"status": "affected",
"version": "18bcbcfe9ca2308ebffb40068b51803da9315d97",
"versionType": "git"
},
{
"lessThan": "766738ecf2b819e54d38763c8d1c8ae6cff14b39",
"status": "affected",
"version": "18bcbcfe9ca2308ebffb40068b51803da9315d97",
"versionType": "git"
},
{
"lessThan": "9ba62966461a8e3cc593b62c56ec62eb2d80436d",
"status": "affected",
"version": "18bcbcfe9ca2308ebffb40068b51803da9315d97",
"versionType": "git"
},
{
"lessThan": "62fc8eb1b1481051f7bab4aa93d79809053dd09f",
"status": "affected",
"version": "18bcbcfe9ca2308ebffb40068b51803da9315d97",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/usb/misc/legousbtower.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.25"
},
{
"lessThan": "2.6.25",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "2.6.25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "2.6.25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "2.6.25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "2.6.25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "2.6.25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "2.6.25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "2.6.25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.25",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: legousbtower: fix use-after-free on disconnect race\n\nmutex_unlock() may access the mutex structure after releasing the lock\nand therefore cannot be used to manage lifetime of objects directly\n(unlike spinlocks and refcounts). [1][2]\n\nUse a kref to release the driver data to avoid use-after-free in\nmutex_unlock() when release() races with disconnect().\n\n[1] a51749ab34d9 (\"locking/mutex: Document that mutex_unlock() is\n non-atomic\")\n[2] 2b9d9e0a9ba0 (\"locking/mutex: Clarify that mutex_unlock(), and most\n other sleeping locks, can still use the lock object\n after it\u0027s unlocked\")"
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:53:43.875Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/11d069f85851997b4ea0adf242ed9672dc749b8f"
},
{
"url": "https://git.kernel.org/stable/c/b4222c05066b252b451f9c8c4730b5b60824ea66"
},
{
"url": "https://git.kernel.org/stable/c/6462de75d2e370c7e74dcfb7b4ae79eb5a6a55ee"
},
{
"url": "https://git.kernel.org/stable/c/0b57e5ddbd89df3bc367463de3d2ca66f99a1a5e"
},
{
"url": "https://git.kernel.org/stable/c/ab2bfd7bec4f134b377ec42f513e90c35db94160"
},
{
"url": "https://git.kernel.org/stable/c/766738ecf2b819e54d38763c8d1c8ae6cff14b39"
},
{
"url": "https://git.kernel.org/stable/c/9ba62966461a8e3cc593b62c56ec62eb2d80436d"
},
{
"url": "https://git.kernel.org/stable/c/62fc8eb1b1481051f7bab4aa93d79809053dd09f"
}
],
"title": "USB: legousbtower: fix use-after-free on disconnect race",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64340",
"datePublished": "2026-07-25T08:50:03.896Z",
"dateReserved": "2026-07-19T15:36:31.781Z",
"dateUpdated": "2026-08-17T04:53:43.875Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64339 (GCVE-0-2026-64339)
Vulnerability from nvd – Published: 2026-07-25 08:50 – Updated: 2026-08-17 04:53
VLAI
EPSS
VEX
Title
usb: misc: usbio: bound bulk IN response length to the received transfer
Summary
In the Linux kernel, the following vulnerability has been resolved:
usb: misc: usbio: bound bulk IN response length to the received transfer
usbio_bulk_msg() copies bpkt_len = le16_to_cpu(bpkt->len) bytes out of
the bulk IN buffer (usbio->rxbuf, allocated with size usbio->rxbuf_len)
into the caller's buffer. bpkt_len is fully controlled by the device
and is only checked against ibuf_len; ibuf_len in turn is checked
against usbio->txbuf_len, not against rxbuf_len:
if ((obuf_len > (usbio->txbuf_len - sizeof(*bpkt))) ||
(ibuf_len > (usbio->txbuf_len - sizeof(*bpkt))))
return -EMSGSIZE;
txbuf_len and rxbuf_len are taken independently from the bulk OUT and
bulk IN endpoint wMaxPacketSize in usbio_probe(). A malicious or
malfunctioning device that advertises a large bulk OUT endpoint and a
small bulk IN endpoint (e.g. by claiming one of the quirk-free IDs such
as the Lattice NX33U, 0x2ac1:0x20cb) therefore makes ibuf_len, and
hence the device-supplied bpkt_len, exceed rxbuf_len. memcpy() then
reads up to txbuf_len - rxbuf_len bytes past the end of the rxbuf slab
object. The over-read bytes are handed back to the i2c layer and on to
user space through i2c-dev, disclosing adjacent slab memory; with KASAN
this is reported as a slab-out-of-bounds read.
The number of bytes actually received is already known: act equals the
URB actual_length and is bounded by rxbuf_len. Reject any response
that claims more payload than was received, mirroring the existing
"act < sizeof(*bpkt)" check just above.
The control path (usbio_ctrl_msg()) is not affected: it uses a single
buffer (ctrlbuf) for both directions, so its analogous copy can never
leave the allocation.
Found by code review. The out-of-bounds read was confirmed under
AddressSanitizer with a faithful userspace model of usbio_bulk_msg()'s
receive path (an rxbuf_len-sized buffer, the same act/ibuf_len/bpkt_len
checks and the memcpy). A USB raw-gadget + dummy_hcd reproducer is
also available.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
121a0f839dbb397af5fabb701cea3e9983223e50 , < 48394f94211cf8fe0ea8604fc441633abf90fc94
(git)
Affected: 121a0f839dbb397af5fabb701cea3e9983223e50 , < fc1b546973c1442d5b947fcdd03581f20ecc5bd2 (git) Affected: 121a0f839dbb397af5fabb701cea3e9983223e50 , < 8c6314489550fa81d41723a0ff33f655b5b6c7b6 (git) |
|
| Linux | Linux |
Affected:
6.18
Unaffected: 0 , < 6.18 (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/usb/misc/usbio.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "48394f94211cf8fe0ea8604fc441633abf90fc94",
"status": "affected",
"version": "121a0f839dbb397af5fabb701cea3e9983223e50",
"versionType": "git"
},
{
"lessThan": "fc1b546973c1442d5b947fcdd03581f20ecc5bd2",
"status": "affected",
"version": "121a0f839dbb397af5fabb701cea3e9983223e50",
"versionType": "git"
},
{
"lessThan": "8c6314489550fa81d41723a0ff33f655b5b6c7b6",
"status": "affected",
"version": "121a0f839dbb397af5fabb701cea3e9983223e50",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/usb/misc/usbio.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.18"
},
{
"lessThan": "6.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.18",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: misc: usbio: bound bulk IN response length to the received transfer\n\nusbio_bulk_msg() copies bpkt_len = le16_to_cpu(bpkt-\u003elen) bytes out of\nthe bulk IN buffer (usbio-\u003erxbuf, allocated with size usbio-\u003erxbuf_len)\ninto the caller\u0027s buffer. bpkt_len is fully controlled by the device\nand is only checked against ibuf_len; ibuf_len in turn is checked\nagainst usbio-\u003etxbuf_len, not against rxbuf_len:\n\n\tif ((obuf_len \u003e (usbio-\u003etxbuf_len - sizeof(*bpkt))) ||\n\t (ibuf_len \u003e (usbio-\u003etxbuf_len - sizeof(*bpkt))))\n\t\treturn -EMSGSIZE;\n\ntxbuf_len and rxbuf_len are taken independently from the bulk OUT and\nbulk IN endpoint wMaxPacketSize in usbio_probe(). A malicious or\nmalfunctioning device that advertises a large bulk OUT endpoint and a\nsmall bulk IN endpoint (e.g. by claiming one of the quirk-free IDs such\nas the Lattice NX33U, 0x2ac1:0x20cb) therefore makes ibuf_len, and\nhence the device-supplied bpkt_len, exceed rxbuf_len. memcpy() then\nreads up to txbuf_len - rxbuf_len bytes past the end of the rxbuf slab\nobject. The over-read bytes are handed back to the i2c layer and on to\nuser space through i2c-dev, disclosing adjacent slab memory; with KASAN\nthis is reported as a slab-out-of-bounds read.\n\nThe number of bytes actually received is already known: act equals the\nURB actual_length and is bounded by rxbuf_len. Reject any response\nthat claims more payload than was received, mirroring the existing\n\"act \u003c sizeof(*bpkt)\" check just above.\n\nThe control path (usbio_ctrl_msg()) is not affected: it uses a single\nbuffer (ctrlbuf) for both directions, so its analogous copy can never\nleave the allocation.\n\nFound by code review. The out-of-bounds read was confirmed under\nAddressSanitizer with a faithful userspace model of usbio_bulk_msg()\u0027s\nreceive path (an rxbuf_len-sized buffer, the same act/ibuf_len/bpkt_len\nchecks and the memcpy). A USB raw-gadget + dummy_hcd reproducer is\nalso available."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:53:42.778Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/48394f94211cf8fe0ea8604fc441633abf90fc94"
},
{
"url": "https://git.kernel.org/stable/c/fc1b546973c1442d5b947fcdd03581f20ecc5bd2"
},
{
"url": "https://git.kernel.org/stable/c/8c6314489550fa81d41723a0ff33f655b5b6c7b6"
}
],
"title": "usb: misc: usbio: bound bulk IN response length to the received transfer",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64339",
"datePublished": "2026-07-25T08:50:03.272Z",
"dateReserved": "2026-07-19T15:36:31.781Z",
"dateUpdated": "2026-08-17T04:53:42.778Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64338 (GCVE-0-2026-64338)
Vulnerability from nvd – Published: 2026-07-25 08:50 – Updated: 2026-08-17 04:53
VLAI
EPSS
VEX
Title
USB: misc: uss720: unregister parport on probe failure
Summary
In the Linux kernel, the following vulnerability has been resolved:
USB: misc: uss720: unregister parport on probe failure
uss720_probe() registers a parport before reading the 1284 register used
to detect unsupported Belkin F5U002 adapters. If get_1284_register()
fails, the error path drops the driver private data and the USB device
reference, but leaves the parport device registered.
Leaving the port registered is more than a private allocation leak:
parport_register_port() has already reserved a parport number and
registered the parport bus device, while pp->private_data still points at
the private data that the common error path is about to release.
Undo the pre-announce registration in the get_1284_register() failure
branch before jumping to the common private-data cleanup path. Clear
priv->pp first, matching the disconnect path and avoiding a stale pointer
in the private data.
This issue was identified during our ongoing static-analysis research while
reviewing kernel code.
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
04736c1bc32197f7d859e01a96ae80a16659931d , < 6bbb98bec71b577fda4f4b48f7aea5874b04a576
(git)
Affected: 4eaf2331a77996bbbaf2b824d452ac8ebda7e6e7 , < 93563243377f8e9b46cc94d9c4f06533dd31b141 (git) Affected: 8fc246a8a456679993df565d3c9e3da28030ee43 , < 1712fd71a5aaf81e47c747f180535fa963ad7830 (git) Affected: 10132ccf99f49b43aeb7470df50d72344a601ad6 , < 0b3073f40cc9f95d5ff0037eb0a06f5c1725a7ea (git) Affected: 3295f1b866bfbcabd625511968e8a5c541f9ab32 , < 5e62d7857fd51b908b8371062ee839739a086bbe (git) Affected: 3295f1b866bfbcabd625511968e8a5c541f9ab32 , < 729b68a5bad71220ae0914c8bdab9488ad5be6c8 (git) Affected: 3295f1b866bfbcabd625511968e8a5c541f9ab32 , < 48dd0b2ec9f2e97c486eb68cd0a64b25c1c3df3e (git) Affected: 3295f1b866bfbcabd625511968e8a5c541f9ab32 , < b4ecbdc4f8830f5586c4a5cfc384c00f20f8f8b3 (git) Affected: 02d13616ca30014ed96302e51a5b0e17664e58bc (git) Affected: dff3b01e91a3df93063b03d0f8dd5c40546687ec (git) Affected: 489d77fbd66375972a380d207f7eb39b00c4a67b (git) Affected: 5.10.221 , < 5.10.261 (semver) Affected: 5.15.162 , < 5.15.212 (semver) Affected: 6.1.96 , < 6.1.178 (semver) Affected: 6.6.36 , < 6.6.145 (semver) Affected: 4.19.317 , < 4.20 (semver) Affected: 5.4.279 , < 5.5 (semver) Affected: 6.9.7 , < 6.10 (semver) |
|
| Linux | Linux |
Affected:
6.10
Unaffected: 0 , < 6.10 (semver) Unaffected: 5.10.261 , ≤ 5.10.* (semver) Unaffected: 5.15.212 , ≤ 5.15.* (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.96 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/usb/misc/uss720.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "6bbb98bec71b577fda4f4b48f7aea5874b04a576",
"status": "affected",
"version": "04736c1bc32197f7d859e01a96ae80a16659931d",
"versionType": "git"
},
{
"lessThan": "93563243377f8e9b46cc94d9c4f06533dd31b141",
"status": "affected",
"version": "4eaf2331a77996bbbaf2b824d452ac8ebda7e6e7",
"versionType": "git"
},
{
"lessThan": "1712fd71a5aaf81e47c747f180535fa963ad7830",
"status": "affected",
"version": "8fc246a8a456679993df565d3c9e3da28030ee43",
"versionType": "git"
},
{
"lessThan": "0b3073f40cc9f95d5ff0037eb0a06f5c1725a7ea",
"status": "affected",
"version": "10132ccf99f49b43aeb7470df50d72344a601ad6",
"versionType": "git"
},
{
"lessThan": "5e62d7857fd51b908b8371062ee839739a086bbe",
"status": "affected",
"version": "3295f1b866bfbcabd625511968e8a5c541f9ab32",
"versionType": "git"
},
{
"lessThan": "729b68a5bad71220ae0914c8bdab9488ad5be6c8",
"status": "affected",
"version": "3295f1b866bfbcabd625511968e8a5c541f9ab32",
"versionType": "git"
},
{
"lessThan": "48dd0b2ec9f2e97c486eb68cd0a64b25c1c3df3e",
"status": "affected",
"version": "3295f1b866bfbcabd625511968e8a5c541f9ab32",
"versionType": "git"
},
{
"lessThan": "b4ecbdc4f8830f5586c4a5cfc384c00f20f8f8b3",
"status": "affected",
"version": "3295f1b866bfbcabd625511968e8a5c541f9ab32",
"versionType": "git"
},
{
"status": "affected",
"version": "02d13616ca30014ed96302e51a5b0e17664e58bc",
"versionType": "git"
},
{
"status": "affected",
"version": "dff3b01e91a3df93063b03d0f8dd5c40546687ec",
"versionType": "git"
},
{
"status": "affected",
"version": "489d77fbd66375972a380d207f7eb39b00c4a67b",
"versionType": "git"
},
{
"lessThan": "5.10.261",
"status": "affected",
"version": "5.10.221",
"versionType": "semver"
},
{
"lessThan": "5.15.212",
"status": "affected",
"version": "5.15.162",
"versionType": "semver"
},
{
"lessThan": "6.1.178",
"status": "affected",
"version": "6.1.96",
"versionType": "semver"
},
{
"lessThan": "6.6.145",
"status": "affected",
"version": "6.6.36",
"versionType": "semver"
},
{
"lessThan": "4.20",
"status": "affected",
"version": "4.19.317",
"versionType": "semver"
},
{
"lessThan": "5.5",
"status": "affected",
"version": "5.4.279",
"versionType": "semver"
},
{
"lessThan": "6.10",
"status": "affected",
"version": "6.9.7",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/usb/misc/uss720.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.10"
},
{
"lessThan": "6.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "5.10.221",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "5.15.162",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "6.1.96",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "6.6.36",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.19.317",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.4.279",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.9.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: misc: uss720: unregister parport on probe failure\n\nuss720_probe() registers a parport before reading the 1284 register used\nto detect unsupported Belkin F5U002 adapters. If get_1284_register()\nfails, the error path drops the driver private data and the USB device\nreference, but leaves the parport device registered.\n\nLeaving the port registered is more than a private allocation leak:\nparport_register_port() has already reserved a parport number and\nregistered the parport bus device, while pp-\u003eprivate_data still points at\nthe private data that the common error path is about to release.\n\nUndo the pre-announce registration in the get_1284_register() failure\nbranch before jumping to the common private-data cleanup path. Clear\npriv-\u003epp first, matching the disconnect path and avoiding a stale pointer\nin the private data.\n\nThis issue was identified during our ongoing static-analysis research while\nreviewing kernel code."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:53:41.636Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/6bbb98bec71b577fda4f4b48f7aea5874b04a576"
},
{
"url": "https://git.kernel.org/stable/c/93563243377f8e9b46cc94d9c4f06533dd31b141"
},
{
"url": "https://git.kernel.org/stable/c/1712fd71a5aaf81e47c747f180535fa963ad7830"
},
{
"url": "https://git.kernel.org/stable/c/0b3073f40cc9f95d5ff0037eb0a06f5c1725a7ea"
},
{
"url": "https://git.kernel.org/stable/c/5e62d7857fd51b908b8371062ee839739a086bbe"
},
{
"url": "https://git.kernel.org/stable/c/729b68a5bad71220ae0914c8bdab9488ad5be6c8"
},
{
"url": "https://git.kernel.org/stable/c/48dd0b2ec9f2e97c486eb68cd0a64b25c1c3df3e"
},
{
"url": "https://git.kernel.org/stable/c/b4ecbdc4f8830f5586c4a5cfc384c00f20f8f8b3"
}
],
"title": "USB: misc: uss720: unregister parport on probe failure",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64338",
"datePublished": "2026-07-25T08:50:02.673Z",
"dateReserved": "2026-07-19T15:36:31.781Z",
"dateUpdated": "2026-08-17T04:53:41.636Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64337 (GCVE-0-2026-64337)
Vulnerability from nvd – Published: 2026-07-25 08:50 – Updated: 2026-08-17 04:53
VLAI
EPSS
VEX
Title
usb: mtu3: unmap request DMA on queue failure
Summary
In the Linux kernel, the following vulnerability has been resolved:
usb: mtu3: unmap request DMA on queue failure
mtu3_gadget_queue() maps the request before checking whether
the QMU GPD ring can accept another transfer. the request is
returned with -EAGAIN before it is linked on the endpoint
request list if mtu3_prepare_transfer() fails.
Normal completion and dequeue paths unmap requests from
mtu3_req_complete(), but this error path never reaches that
helper, so the DMA mapping is left active. Unmap the request
before returning from the failed queue path.
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
df2069acb00569a6299d6e11aa1865eeba463848 , < 3cee30f1138281a1d247bb053a1ad4f7c5b04e98
(git)
Affected: df2069acb00569a6299d6e11aa1865eeba463848 , < f3c4026524d3660c73ef2838b99776d37631e039 (git) Affected: df2069acb00569a6299d6e11aa1865eeba463848 , < e8f739a3860d043dcc135371637e82f53132efe5 (git) Affected: df2069acb00569a6299d6e11aa1865eeba463848 , < 4183874b7925f4a98b400cf857bea26ee87da236 (git) Affected: df2069acb00569a6299d6e11aa1865eeba463848 , < 00c3fef4c2dc2c7cbd8281f8fda09d1913420f09 (git) Affected: df2069acb00569a6299d6e11aa1865eeba463848 , < 8c29d9cfab1c3cf0d0b7fcdf9255597be30aa3e1 (git) Affected: df2069acb00569a6299d6e11aa1865eeba463848 , < 835b0596d4c9bdef93f842d8f826978fb4956b74 (git) Affected: df2069acb00569a6299d6e11aa1865eeba463848 , < 0bddda5a11665c210339de76d27ebbd1a2e0b43c (git) |
|
| Linux | Linux |
Affected:
4.10
Unaffected: 0 , < 4.10 (semver) Unaffected: 5.10.261 , ≤ 5.10.* (semver) Unaffected: 5.15.212 , ≤ 5.15.* (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.96 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/usb/mtu3/mtu3_gadget.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "3cee30f1138281a1d247bb053a1ad4f7c5b04e98",
"status": "affected",
"version": "df2069acb00569a6299d6e11aa1865eeba463848",
"versionType": "git"
},
{
"lessThan": "f3c4026524d3660c73ef2838b99776d37631e039",
"status": "affected",
"version": "df2069acb00569a6299d6e11aa1865eeba463848",
"versionType": "git"
},
{
"lessThan": "e8f739a3860d043dcc135371637e82f53132efe5",
"status": "affected",
"version": "df2069acb00569a6299d6e11aa1865eeba463848",
"versionType": "git"
},
{
"lessThan": "4183874b7925f4a98b400cf857bea26ee87da236",
"status": "affected",
"version": "df2069acb00569a6299d6e11aa1865eeba463848",
"versionType": "git"
},
{
"lessThan": "00c3fef4c2dc2c7cbd8281f8fda09d1913420f09",
"status": "affected",
"version": "df2069acb00569a6299d6e11aa1865eeba463848",
"versionType": "git"
},
{
"lessThan": "8c29d9cfab1c3cf0d0b7fcdf9255597be30aa3e1",
"status": "affected",
"version": "df2069acb00569a6299d6e11aa1865eeba463848",
"versionType": "git"
},
{
"lessThan": "835b0596d4c9bdef93f842d8f826978fb4956b74",
"status": "affected",
"version": "df2069acb00569a6299d6e11aa1865eeba463848",
"versionType": "git"
},
{
"lessThan": "0bddda5a11665c210339de76d27ebbd1a2e0b43c",
"status": "affected",
"version": "df2069acb00569a6299d6e11aa1865eeba463848",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/usb/mtu3/mtu3_gadget.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.10"
},
{
"lessThan": "4.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: mtu3: unmap request DMA on queue failure\n\nmtu3_gadget_queue() maps the request before checking whether\nthe QMU GPD ring can accept another transfer. the request is\nreturned with -EAGAIN before it is linked on the endpoint\nrequest list if mtu3_prepare_transfer() fails.\n\nNormal completion and dequeue paths unmap requests from\nmtu3_req_complete(), but this error path never reaches that\nhelper, so the DMA mapping is left active. Unmap the request\nbefore returning from the failed queue path."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:53:40.517Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/3cee30f1138281a1d247bb053a1ad4f7c5b04e98"
},
{
"url": "https://git.kernel.org/stable/c/f3c4026524d3660c73ef2838b99776d37631e039"
},
{
"url": "https://git.kernel.org/stable/c/e8f739a3860d043dcc135371637e82f53132efe5"
},
{
"url": "https://git.kernel.org/stable/c/4183874b7925f4a98b400cf857bea26ee87da236"
},
{
"url": "https://git.kernel.org/stable/c/00c3fef4c2dc2c7cbd8281f8fda09d1913420f09"
},
{
"url": "https://git.kernel.org/stable/c/8c29d9cfab1c3cf0d0b7fcdf9255597be30aa3e1"
},
{
"url": "https://git.kernel.org/stable/c/835b0596d4c9bdef93f842d8f826978fb4956b74"
},
{
"url": "https://git.kernel.org/stable/c/0bddda5a11665c210339de76d27ebbd1a2e0b43c"
}
],
"title": "usb: mtu3: unmap request DMA on queue failure",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64337",
"datePublished": "2026-07-25T08:50:02.066Z",
"dateReserved": "2026-07-19T15:36:31.781Z",
"dateUpdated": "2026-08-17T04:53:40.517Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64336 (GCVE-0-2026-64336)
Vulnerability from nvd – Published: 2026-07-25 08:50 – Updated: 2026-08-23 12:45
VLAI
EPSS
VEX
Title
USB: serial: keyspan_pda: fix information leak
Summary
In the Linux kernel, the following vulnerability has been resolved:
USB: serial: keyspan_pda: fix information leak
The write() callback is supposed to return the number of characters
accepted or a negative errno. Since the addition of write fifo support
the keyspan_pda implementation will however return the number characters
submitted to the device if the write urb is not already in use. If this
number is larger than the number of characters passed to write(), the
line discipline continues writing data from beyond the tty write buffer.
Fix the information leak by making sure that keyspan_pda_write_start()
returns zero on success as intended.
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
02407bc7d42347da7ed2a3926a0b824bfc614914 , < cccef1711efbcdbe999738ac27d37b9ef6271abd
(git)
Affected: 034e38e8f68767fb5438ae3e608ee82919674177 , < b069b7029862fafaff331d4c664d97d4ae828d6d (git) Affected: 034e38e8f68767fb5438ae3e608ee82919674177 , < e52ca411f50539ff1d0c877b9312771ca8a858c1 (git) Affected: 034e38e8f68767fb5438ae3e608ee82919674177 , < 2f7a6b8ab3845bd1da02604f1a874b52a4555a72 (git) Affected: 034e38e8f68767fb5438ae3e608ee82919674177 , < e1494191a3aac665d3a2fce16169a97c346253ec (git) Affected: 034e38e8f68767fb5438ae3e608ee82919674177 , < cf6ca0aefae03958cfb5b189b0adbfb25c06bfac (git) Affected: 034e38e8f68767fb5438ae3e608ee82919674177 , < d4b12b6b395e43a2b1d80be3745631fcaa9c047b (git) Affected: 034e38e8f68767fb5438ae3e608ee82919674177 , < 6bfc8d01ac4068eced509f8fc74d0cd205e4dcec (git) |
|
| Linux | Linux |
Affected:
5.11
Unaffected: 0 , < 5.11 (semver) Unaffected: 5.15.212 , ≤ 5.15.* (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.96 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/usb/serial/keyspan_pda.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "cccef1711efbcdbe999738ac27d37b9ef6271abd",
"status": "affected",
"version": "02407bc7d42347da7ed2a3926a0b824bfc614914",
"versionType": "git"
},
{
"lessThan": "b069b7029862fafaff331d4c664d97d4ae828d6d",
"status": "affected",
"version": "034e38e8f68767fb5438ae3e608ee82919674177",
"versionType": "git"
},
{
"lessThan": "e52ca411f50539ff1d0c877b9312771ca8a858c1",
"status": "affected",
"version": "034e38e8f68767fb5438ae3e608ee82919674177",
"versionType": "git"
},
{
"lessThan": "2f7a6b8ab3845bd1da02604f1a874b52a4555a72",
"status": "affected",
"version": "034e38e8f68767fb5438ae3e608ee82919674177",
"versionType": "git"
},
{
"lessThan": "e1494191a3aac665d3a2fce16169a97c346253ec",
"status": "affected",
"version": "034e38e8f68767fb5438ae3e608ee82919674177",
"versionType": "git"
},
{
"lessThan": "cf6ca0aefae03958cfb5b189b0adbfb25c06bfac",
"status": "affected",
"version": "034e38e8f68767fb5438ae3e608ee82919674177",
"versionType": "git"
},
{
"lessThan": "d4b12b6b395e43a2b1d80be3745631fcaa9c047b",
"status": "affected",
"version": "034e38e8f68767fb5438ae3e608ee82919674177",
"versionType": "git"
},
{
"lessThan": "6bfc8d01ac4068eced509f8fc74d0cd205e4dcec",
"status": "affected",
"version": "034e38e8f68767fb5438ae3e608ee82919674177",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/usb/serial/keyspan_pda.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.11"
},
{
"lessThan": "5.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: serial: keyspan_pda: fix information leak\n\nThe write() callback is supposed to return the number of characters\naccepted or a negative errno. Since the addition of write fifo support\nthe keyspan_pda implementation will however return the number characters\nsubmitted to the device if the write urb is not already in use. If this\nnumber is larger than the number of characters passed to write(), the\nline discipline continues writing data from beyond the tty write buffer.\n\nFix the information leak by making sure that keyspan_pda_write_start()\nreturns zero on success as intended."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-23T12:45:41.365Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/cccef1711efbcdbe999738ac27d37b9ef6271abd"
},
{
"url": "https://git.kernel.org/stable/c/b069b7029862fafaff331d4c664d97d4ae828d6d"
},
{
"url": "https://git.kernel.org/stable/c/e52ca411f50539ff1d0c877b9312771ca8a858c1"
},
{
"url": "https://git.kernel.org/stable/c/2f7a6b8ab3845bd1da02604f1a874b52a4555a72"
},
{
"url": "https://git.kernel.org/stable/c/e1494191a3aac665d3a2fce16169a97c346253ec"
},
{
"url": "https://git.kernel.org/stable/c/cf6ca0aefae03958cfb5b189b0adbfb25c06bfac"
},
{
"url": "https://git.kernel.org/stable/c/d4b12b6b395e43a2b1d80be3745631fcaa9c047b"
},
{
"url": "https://git.kernel.org/stable/c/6bfc8d01ac4068eced509f8fc74d0cd205e4dcec"
}
],
"title": "USB: serial: keyspan_pda: fix information leak",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64336",
"datePublished": "2026-07-25T08:50:01.444Z",
"dateReserved": "2026-07-19T15:36:31.781Z",
"dateUpdated": "2026-08-23T12:45:41.365Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64335 (GCVE-0-2026-64335)
Vulnerability from nvd – Published: 2026-07-25 08:50 – Updated: 2026-08-17 04:53
VLAI
EPSS
VEX
Title
USB: serial: digi_acceleport: fix broken rx after throttle
Summary
In the Linux kernel, the following vulnerability has been resolved:
USB: serial: digi_acceleport: fix broken rx after throttle
If the port is closed while throttled, the read urb is never resubmitted
and the port will not receive any further data until the device is
reconnected (or the driver is rebound).
Clear the throttle flags and submit the urb if needed when opening the
port.
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 4f3f6f44db71e469933a7c36c5d57d937ba0a21b
(git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < d5d2660caef78d4c996d34d123574c8e86f5b5ac (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 61954033326fc7e637ed2aeeb4b52021e0ee4657 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 8d50a910194f66566a5eb252b33283855c8d5203 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < abacd67e6f689c62d8a13e3da25f4272bc9ad4af (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < eab394781e9321c0c7e97a24fd092387cb262f40 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 92fa3e1a49848509ea3f7995751963fc65095998 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 83a3dfc018943b05b6daf3a6f891833e1aabfa1f (git) |
|
| Linux | Linux |
Affected:
2.6.12
Unaffected: 0 , < 2.6.12 (semver) Unaffected: 5.10.261 , ≤ 5.10.* (semver) Unaffected: 5.15.212 , ≤ 5.15.* (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.96 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/usb/serial/digi_acceleport.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "4f3f6f44db71e469933a7c36c5d57d937ba0a21b",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "d5d2660caef78d4c996d34d123574c8e86f5b5ac",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "61954033326fc7e637ed2aeeb4b52021e0ee4657",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "8d50a910194f66566a5eb252b33283855c8d5203",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "abacd67e6f689c62d8a13e3da25f4272bc9ad4af",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "eab394781e9321c0c7e97a24fd092387cb262f40",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "92fa3e1a49848509ea3f7995751963fc65095998",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "83a3dfc018943b05b6daf3a6f891833e1aabfa1f",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/usb/serial/digi_acceleport.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.12"
},
{
"lessThan": "2.6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: serial: digi_acceleport: fix broken rx after throttle\n\nIf the port is closed while throttled, the read urb is never resubmitted\nand the port will not receive any further data until the device is\nreconnected (or the driver is rebound).\n\nClear the throttle flags and submit the urb if needed when opening the\nport."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:53:38.295Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/4f3f6f44db71e469933a7c36c5d57d937ba0a21b"
},
{
"url": "https://git.kernel.org/stable/c/d5d2660caef78d4c996d34d123574c8e86f5b5ac"
},
{
"url": "https://git.kernel.org/stable/c/61954033326fc7e637ed2aeeb4b52021e0ee4657"
},
{
"url": "https://git.kernel.org/stable/c/8d50a910194f66566a5eb252b33283855c8d5203"
},
{
"url": "https://git.kernel.org/stable/c/abacd67e6f689c62d8a13e3da25f4272bc9ad4af"
},
{
"url": "https://git.kernel.org/stable/c/eab394781e9321c0c7e97a24fd092387cb262f40"
},
{
"url": "https://git.kernel.org/stable/c/92fa3e1a49848509ea3f7995751963fc65095998"
},
{
"url": "https://git.kernel.org/stable/c/83a3dfc018943b05b6daf3a6f891833e1aabfa1f"
}
],
"title": "USB: serial: digi_acceleport: fix broken rx after throttle",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64335",
"datePublished": "2026-07-25T08:50:00.835Z",
"dateReserved": "2026-07-19T15:36:31.781Z",
"dateUpdated": "2026-08-17T04:53:38.295Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64334 (GCVE-0-2026-64334)
Vulnerability from nvd – Published: 2026-07-25 08:50 – Updated: 2026-08-17 04:53
VLAI
EPSS
VEX
Title
USB: serial: digi_acceleport: fix hard lockup on disconnect
Summary
In the Linux kernel, the following vulnerability has been resolved:
USB: serial: digi_acceleport: fix hard lockup on disconnect
If submitting the OOB write urb fails persistently (e.g if the device is
being disconnected) the driver would loop indefinitely with interrupts
disabled.
Check for urb submission errors when sending OOB commands to avoid
hanging if, for example, open(), set_termios() or close() races with a
physical disconnect.
This is issue was flagged by Sashiko when reviewing an unrelated change
to the driver.
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 6e51147c2744d15730084dc89cc99180d3de4184
(git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 6a8592ace932081ea11aea41c460a1ca0f6344a4 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 5a82d842e8c35227d7227f19e5e654df1451782c (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < bcfeae431db9986c2b313e6a760f2ac8df61e138 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 2067b3838da6e4af03bae3630414193188d754b2 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 2b7dc482f859f2d027db07ff0efc1c5df5b3451a (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 79bc131df0e50f8f663c1fdbbe952aaf193a8d39 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 5c1ea24b53bf3bfb859f0a05573997487975da23 (git) |
|
| Linux | Linux |
Affected:
2.6.12
Unaffected: 0 , < 2.6.12 (semver) Unaffected: 5.10.261 , ≤ 5.10.* (semver) Unaffected: 5.15.212 , ≤ 5.15.* (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.96 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/usb/serial/digi_acceleport.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "6e51147c2744d15730084dc89cc99180d3de4184",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "6a8592ace932081ea11aea41c460a1ca0f6344a4",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "5a82d842e8c35227d7227f19e5e654df1451782c",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "bcfeae431db9986c2b313e6a760f2ac8df61e138",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "2067b3838da6e4af03bae3630414193188d754b2",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "2b7dc482f859f2d027db07ff0efc1c5df5b3451a",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "79bc131df0e50f8f663c1fdbbe952aaf193a8d39",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "5c1ea24b53bf3bfb859f0a05573997487975da23",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/usb/serial/digi_acceleport.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.12"
},
{
"lessThan": "2.6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: serial: digi_acceleport: fix hard lockup on disconnect\n\nIf submitting the OOB write urb fails persistently (e.g if the device is\nbeing disconnected) the driver would loop indefinitely with interrupts\ndisabled.\n\nCheck for urb submission errors when sending OOB commands to avoid\nhanging if, for example, open(), set_termios() or close() races with a\nphysical disconnect.\n\nThis is issue was flagged by Sashiko when reviewing an unrelated change\nto the driver."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:53:37.202Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/6e51147c2744d15730084dc89cc99180d3de4184"
},
{
"url": "https://git.kernel.org/stable/c/6a8592ace932081ea11aea41c460a1ca0f6344a4"
},
{
"url": "https://git.kernel.org/stable/c/5a82d842e8c35227d7227f19e5e654df1451782c"
},
{
"url": "https://git.kernel.org/stable/c/bcfeae431db9986c2b313e6a760f2ac8df61e138"
},
{
"url": "https://git.kernel.org/stable/c/2067b3838da6e4af03bae3630414193188d754b2"
},
{
"url": "https://git.kernel.org/stable/c/2b7dc482f859f2d027db07ff0efc1c5df5b3451a"
},
{
"url": "https://git.kernel.org/stable/c/79bc131df0e50f8f663c1fdbbe952aaf193a8d39"
},
{
"url": "https://git.kernel.org/stable/c/5c1ea24b53bf3bfb859f0a05573997487975da23"
}
],
"title": "USB: serial: digi_acceleport: fix hard lockup on disconnect",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64334",
"datePublished": "2026-07-25T08:50:00.229Z",
"dateReserved": "2026-07-19T15:36:31.781Z",
"dateUpdated": "2026-08-17T04:53:37.202Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}