CVE-2026-63927 (GCVE-0-2026-63927)

Vulnerability from cvelistv5 – Published: 2026-07-19 14:55 – Updated: 2026-08-05 12:37
VLAI
Title
usb: dwc2: Fix use after free in debug code
Summary
In the Linux kernel, the following vulnerability has been resolved: usb: dwc2: Fix use after free in debug code We're not allowed to dereference "urb" after calling usb_hcd_giveback_urb() so save the urb->status ahead of time.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 7359d482eb4d3967cc8be354405ae6be6eaf732c , < d5fc183ed614aeba6779cc992325be560f9a4451 (git)
Affected: 7359d482eb4d3967cc8be354405ae6be6eaf732c , < 63b0dafa676aad4d0c3f01a61ad8e2990907660c (git)
Affected: 7359d482eb4d3967cc8be354405ae6be6eaf732c , < 9fe1d84f7e2cf33634e8afb7f4b7f8de182dd913 (git)
Affected: 7359d482eb4d3967cc8be354405ae6be6eaf732c , < 0584af4fe40fa5e254a05d69ce658746de641708 (git)
Affected: 7359d482eb4d3967cc8be354405ae6be6eaf732c , < a15eeeceb94cbc04edef395e4d777ff554bdc27d (git)
Affected: 7359d482eb4d3967cc8be354405ae6be6eaf732c , < 84ea928ed584756e59c6ac09736f12d1db95ded0 (git)
Affected: 7359d482eb4d3967cc8be354405ae6be6eaf732c , < 6d0b79d1d1118145e48a68192b6d733e39387053 (git)
Affected: 7359d482eb4d3967cc8be354405ae6be6eaf732c , < 9ea06a3fbf9f16e0d98c52cb3b99642be15ec281 (git)
guessed Create a notification for this product.
Linux Linux Affected: 3.10
Unaffected: 0 , < 3.10 (semver)
Unaffected: 5.10.259 , ≤ 5.10.* (semver)
Unaffected: 5.15.210 , ≤ 5.15.* (semver)
Unaffected: 6.1.176 , ≤ 6.1.* (semver)
Unaffected: 6.6.143 , ≤ 6.6.* (semver)
Unaffected: 6.12.93 , ≤ 6.12.* (semver)
Unaffected: 6.18.35 , ≤ 6.18.* (semver)
Unaffected: 7.0.12 , ≤ 7.0.* (semver)
Unaffected: 7.1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/dwc2/hcd.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d5fc183ed614aeba6779cc992325be560f9a4451",
              "status": "affected",
              "version": "7359d482eb4d3967cc8be354405ae6be6eaf732c",
              "versionType": "git"
            },
            {
              "lessThan": "63b0dafa676aad4d0c3f01a61ad8e2990907660c",
              "status": "affected",
              "version": "7359d482eb4d3967cc8be354405ae6be6eaf732c",
              "versionType": "git"
            },
            {
              "lessThan": "9fe1d84f7e2cf33634e8afb7f4b7f8de182dd913",
              "status": "affected",
              "version": "7359d482eb4d3967cc8be354405ae6be6eaf732c",
              "versionType": "git"
            },
            {
              "lessThan": "0584af4fe40fa5e254a05d69ce658746de641708",
              "status": "affected",
              "version": "7359d482eb4d3967cc8be354405ae6be6eaf732c",
              "versionType": "git"
            },
            {
              "lessThan": "a15eeeceb94cbc04edef395e4d777ff554bdc27d",
              "status": "affected",
              "version": "7359d482eb4d3967cc8be354405ae6be6eaf732c",
              "versionType": "git"
            },
            {
              "lessThan": "84ea928ed584756e59c6ac09736f12d1db95ded0",
              "status": "affected",
              "version": "7359d482eb4d3967cc8be354405ae6be6eaf732c",
              "versionType": "git"
            },
            {
              "lessThan": "6d0b79d1d1118145e48a68192b6d733e39387053",
              "status": "affected",
              "version": "7359d482eb4d3967cc8be354405ae6be6eaf732c",
              "versionType": "git"
            },
            {
              "lessThan": "9ea06a3fbf9f16e0d98c52cb3b99642be15ec281",
              "status": "affected",
              "version": "7359d482eb4d3967cc8be354405ae6be6eaf732c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/dwc2/hcd.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.10"
            },
            {
              "lessThan": "3.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.259",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.210",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.176",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.143",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.93",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.35",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.259",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.210",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.176",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.143",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.93",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.35",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.12",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: dwc2: Fix use after free in debug code\n\nWe\u0027re not allowed to dereference \"urb\" after calling\nusb_hcd_giveback_urb() so save the urb-\u003estatus ahead of time."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable dwc2 HCD urb_dequeue path is reached from local usbfs ioctls (USBDEVFS_SUBMITURB/DISCARDURB) on /dev/bus/usb device nodes, as well as from kernel unlink paths during USB I/O cancellation on dwc2-equipped embedded systems, kiosks, and mobile OTG hosts.\nAC:L - Once debug is enabled, an attacker can reliably drive the path by submitting and cancelling URBs (or forcing disconnect/error unlink storms) and can control the HCD_BH giveback race by running concurrent cancellation requests.\nPR:L - Triggering urb dequeue via usbfs requires only local user access to a USB device node (typically root or plugdev-group membership), which is low privilege and commonly available on dwc2 embedded platforms; no real root in the init namespace is required.\nUI:N - Exploitation requires only the attacker to submit and cancel USB transfers (or insert/disconnect a malicious USB device); no action by a separate victim user is needed.\nS:U - The UAF corrupts kernel heap memory within the kernel\u0027s own security authority and does not by itself cross a VM, container, or IOMMU boundary.\nC:H - Use-after-free of a kmalloc-backed struct urb after giveback can be groomed via heap spraying to obtain arbitrary kernel memory read primitives, not merely a bounded leak.\nI:H - UAF on the URB object in the general kmalloc slab enables attacker-controlled reuse of freed memory, supporting control-flow hijack and arbitrary kernel write/code execution.\nA:H - The post-giveback dereference can cause kernel oops/panic during URB teardown, and successful UAF exploitation can crash or hang the system."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:37:22.350Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d5fc183ed614aeba6779cc992325be560f9a4451"
        },
        {
          "url": "https://git.kernel.org/stable/c/63b0dafa676aad4d0c3f01a61ad8e2990907660c"
        },
        {
          "url": "https://git.kernel.org/stable/c/9fe1d84f7e2cf33634e8afb7f4b7f8de182dd913"
        },
        {
          "url": "https://git.kernel.org/stable/c/0584af4fe40fa5e254a05d69ce658746de641708"
        },
        {
          "url": "https://git.kernel.org/stable/c/a15eeeceb94cbc04edef395e4d777ff554bdc27d"
        },
        {
          "url": "https://git.kernel.org/stable/c/84ea928ed584756e59c6ac09736f12d1db95ded0"
        },
        {
          "url": "https://git.kernel.org/stable/c/6d0b79d1d1118145e48a68192b6d733e39387053"
        },
        {
          "url": "https://git.kernel.org/stable/c/9ea06a3fbf9f16e0d98c52cb3b99642be15ec281"
        }
      ],
      "title": "usb: dwc2: Fix use after free in debug code",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-63927",
    "datePublished": "2026-07-19T14:55:27.864Z",
    "dateReserved": "2026-07-19T07:54:57.021Z",
    "dateUpdated": "2026-08-05T12:37:22.350Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-63927",
      "date": "2026-09-21",
      "epss": "0.00164",
      "percentile": "0.06011"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/usb/dwc2/hcd.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "d5fc183ed614aeba6779cc992325be560f9a4451",
                    "status": "affected",
                    "version": "7359d482eb4d3967cc8be354405ae6be6eaf732c",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "63b0dafa676aad4d0c3f01a61ad8e2990907660c",
                    "status": "affected",
                    "version": "7359d482eb4d3967cc8be354405ae6be6eaf732c",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "9fe1d84f7e2cf33634e8afb7f4b7f8de182dd913",
                    "status": "affected",
                    "version": "7359d482eb4d3967cc8be354405ae6be6eaf732c",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "0584af4fe40fa5e254a05d69ce658746de641708",
                    "status": "affected",
                    "version": "7359d482eb4d3967cc8be354405ae6be6eaf732c",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "a15eeeceb94cbc04edef395e4d777ff554bdc27d",
                    "status": "affected",
                    "version": "7359d482eb4d3967cc8be354405ae6be6eaf732c",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "84ea928ed584756e59c6ac09736f12d1db95ded0",
                    "status": "affected",
                    "version": "7359d482eb4d3967cc8be354405ae6be6eaf732c",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6d0b79d1d1118145e48a68192b6d733e39387053",
                    "status": "affected",
                    "version": "7359d482eb4d3967cc8be354405ae6be6eaf732c",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "9ea06a3fbf9f16e0d98c52cb3b99642be15ec281",
                    "status": "affected",
                    "version": "7359d482eb4d3967cc8be354405ae6be6eaf732c",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/usb/dwc2/hcd.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "3.10"
                  },
                  {
                    "lessThan": "3.10",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.259",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.210",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.176",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.143",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.93",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.35",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.0.*",
                    "status": "unaffected",
                    "version": "7.0.12",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: dwc2: Fix use after free in debug code\n\nWe\u0027re not allowed to dereference \"urb\" after calling\nusb_hcd_giveback_urb() so save the urb-\u003estatus ahead of time."
          }
        ],
        "id": "CVE-2026-63927",
        "lastModified": "2026-07-27T17:44:23.777",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-07-19T16:17:11.040",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/0584af4fe40fa5e254a05d69ce658746de641708"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/63b0dafa676aad4d0c3f01a61ad8e2990907660c"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/6d0b79d1d1118145e48a68192b6d733e39387053"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/84ea928ed584756e59c6ac09736f12d1db95ded0"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/9ea06a3fbf9f16e0d98c52cb3b99642be15ec281"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/9fe1d84f7e2cf33634e8afb7f4b7f8de182dd913"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/a15eeeceb94cbc04edef395e4d777ff554bdc27d"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/d5fc183ed614aeba6779cc992325be560f9a4451"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Awaiting Analysis"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-05T14:20:22+00:00",
      "cve": "CVE-2026-63927",
      "id": "CVE-2026-63927",
      "initial_release_date": "2026-07-19T00:00:00+00:00",
      "product_status:known_affected": "76",
      "product_status:known_not_affected": "199",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: usb: dwc2: Fix use after free in debug code",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-63927.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-10T02:30:05Z",
      "cve": "CVE-2026-63927",
      "id": "CVE-2026-63927",
      "initial_release_date": "2026-07-21T13:03:24Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "617",
      "product_status:known_not_affected": "50",
      "product_status:recommended": "273",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-63927",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-63927.json",
      "version": "11"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.