CVE-2026-64331

Analyzed Analyzed - Analysis Complete

USBIP vUDC NULL Pointer Dereference in Linux Kernel

Publication date: 2026-07-25

Last updated on: 2026-09-03

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: usbip: vudc: fix NULL deref in vep_dequeue() vep_alloc_request() wasn't initializing vrequest->udc, so cancellations on the FunctionFS AIO path were arriving in vep_dequeue without a valid UDC reference. Since vrequest->udc is never actually properly used anywhere, we opt to remove it, and update vep_dequeue to obtain a reference to the udc with ep_to_vudc(), consistent with the other vep_ ops. AFAICT this bug has existed for ~10 years. Seems that nobody has really stressed the FunctionFS AIO path on usbip's vudc. I tested this fix in a QEMU aarch64 guest driving FunctionFS endpoints via AIO. Before the fix, running `usbip attach` from the host would cause the guest to oops with the following backtrace: Call trace: vep_dequeue+0x1c/0xe4 (P) usb_ep_dequeue+0x14/0x20 ffs_aio_cancel+0x24/0x34 __arm64_sys_io_cancel+0xb0/0x124 do_el0_svc+0x68/0x100 el0_svc+0x18/0x5c el0t_64_sync_handler+0x98/0xdc el0t_64_sync+0x154/0x158

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-25

Last Modified

2026-09-03

Generated

2026-09-04

AI Q&A

2026-07-25

EPSS Evaluated

2026-09-02

NVD

CVE-2026-64331

EUVD

EUVD-2026-48875

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	From 5.11 (inc) to 5.15.212 (exc)
linux	linux_kernel	From 5.16 (inc) to 6.1.178 (exc)
linux	linux_kernel	From 6.2 (inc) to 6.6.145 (exc)
linux	linux_kernel	From 6.7 (inc) to 6.12.96 (exc)
linux	linux_kernel	From 6.13 (inc) to 6.18.39 (exc)
linux	linux_kernel	From 6.19 (inc) to 7.1.4 (exc)
linux	linux_kernel	7.2
linux	linux_kernel	7.2
linux	linux_kernel	From 4.7 (inc) to 5.10.261 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-476	The product dereferences a pointer that it expects to be valid but is NULL.

Attack-Flow Graph

Executive Summary

This is a NULL pointer dereference vulnerability in the Linux kernel's USB/IP (usbip) subsystem, specifically in the virtual USB device controller (vudc) component. The issue occurs in the vep_dequeue() function where a missing initialization of vrequest->udc leads to a crash when processing cancellations on the FunctionFS AIO path.

Detection Guidance

This vulnerability is specific to the Linux kernel's usbip vudc component and may cause system crashes when FunctionFS AIO operations are used. Detection requires checking kernel logs for oops messages or crashes related to usbip operations. Monitor logs with commands like dmesg | grep -i usbip or journalctl -k | grep -i oops after running usbip operations.

Impact Analysis

This vulnerability could cause a system crash (kernel oops) when certain USB operations are canceled, potentially leading to denial of service. It affects systems using USB/IP with FunctionFS endpoints, particularly in virtualized environments like QEMU guests.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA. It is a local denial-of-service issue in the Linux kernel's usbip subsystem that could cause system crashes but does not involve data breaches or unauthorized access to sensitive information.

Mitigation Strategies

Apply the kernel patch that resolves this issue by updating to a fixed Linux kernel version. Avoid using FunctionFS AIO operations with usbip until patched. If immediate mitigation is needed, disable the usbip vudc module with rmmod vudc or block usbip-related operations.

Hi! I’m here to help you understand CVE-2026-64331. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70