CVE-2026-64337
Received Received - Intake

BaseFortify

Publication date: 2026-07-25

Last updated on: 2026-07-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: usb: mtu3: unmap request DMA on queue failure mtu3_gadget_queue() maps the request before checking whether the QMU GPD ring can accept another transfer. the request is returned with -EAGAIN before it is linked on the endpoint request list if mtu3_prepare_transfer() fails. Normal completion and dequeue paths unmap requests from mtu3_req_complete(), but this error path never reaches that helper, so the DMA mapping is left active. Unmap the request before returning from the failed queue path.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-25
Last Modified
2026-07-25
Generated
2026-07-25
AI Q&A
2026-07-25
EPSS Evaluated
N/A
NVD
CVE-2026-64337
EUVD
EUVD-2026-48881

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves improper handling of DMA mappings in the USB mtu3 gadget driver. When a request fails to queue due to insufficient space in the QMU GPD ring, the DMA mapping is not properly unmapped before the request is returned with an error. This leaves the DMA mapping active, potentially causing resource leaks or other issues.

Detection Guidance

This vulnerability is specific to the Linux kernel's USB subsystem (mtu3 driver) and does not have network-based detection methods. Detection requires checking kernel logs for USB-related errors or examining the mtu3 driver code for unmap failures. Use commands like dmesg | grep mtu3 or journalctl -k | grep mtu3 to inspect kernel logs for related errors.

Impact Analysis

This vulnerability could lead to system instability or resource exhaustion if exploited repeatedly. It may cause USB functionality issues or crashes in systems using the affected Linux kernel USB mtu3 driver.

Mitigation Strategies

Apply the latest Linux kernel updates from your distribution to patch this vulnerability. If immediate patching is not possible, consider disabling the mtu3 USB driver module if it is not required. Monitor kernel logs for USB-related errors as a potential indicator of exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64337. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart