CVE-2026-64348

Analyzed Analyzed - Analysis Complete

Memory Leak in Linux Kernel USB Subsystem

Publication date: 2026-07-25

Last updated on: 2026-09-03

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: usb: free iso schedules on failed submit EHCI and FOTG210 isochronous submits build an ehci_iso_sched before linking the URB to the endpoint queue, and keep the staged schedule in urb->hcpriv until iso_stream_schedule() and the link helpers consume it. If the controller is no longer accessible, or usb_hcd_link_urb_to_ep() fails, submit jumps to done_not_linked before that handoff happens and leaks the staged schedule still attached to urb->hcpriv. Free the staged schedule from done_not_linked when submit fails before the URB is linked and clear urb->hcpriv after the free. The bug was first flagged by an experimental analysis tool we are developing for kernel memory-management bugs while analyzing v6.13-rc1. The tool is still under development and is not yet publicly available. Manual inspection confirms that the bug is still present in v7.1.1. An x86_64 allyesconfig build showed no new warnings. As we do not have an EHCI host controller with a USB isochronous device to test with, no runtime testing was able to be performed.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-25

Last Modified

2026-09-03

Generated

2026-09-03

AI Q&A

2026-07-25

EPSS Evaluated

2026-09-02

NVD

CVE-2026-64348

EUVD

EUVD-2026-48892

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	2.6.15
linux	linux_kernel	2.6.15
linux	linux_kernel	2.6.15
linux	linux_kernel	2.6.15
linux	linux_kernel	2.6.15
linux	linux_kernel	From 6.7 (inc) to 6.12.96 (exc)
linux	linux_kernel	From 6.13 (inc) to 6.18.39 (exc)
linux	linux_kernel	From 6.19 (inc) to 7.1.4 (exc)
linux	linux_kernel	7.2
linux	linux_kernel	7.2
linux	linux_kernel	From 5.11 (inc) to 6.6.145 (exc)
linux	linux_kernel	From 2.6.15.1 (inc) to 5.10.261 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-416	The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a memory leak in the USB subsystem. When isochronous USB submissions fail, the kernel fails to properly free a scheduled memory structure (ehci_iso_sched) attached to a URB (USB Request Block). This happens because the cleanup process jumps to a label before the scheduled schedule is properly linked and freed, leaving the memory allocated.

Detection Guidance

This vulnerability is specific to the Linux kernel's USB subsystem, particularly EHCI and FOTG210 controllers. Detection requires kernel-level inspection for memory leaks in isochronous USB submissions. Check kernel logs for errors related to usb_hcd_link_urb_to_ep() failures or memory leaks in USB drivers. Use commands like dmesg | grep -i usb or journalctl -k | grep -i usb to review USB-related errors.

Impact Analysis

This vulnerability could lead to memory exhaustion over time if many failed USB submissions occur, potentially causing system instability or crashes. It may also indicate broader memory management issues in the kernel, though no active exploitation or runtime testing has been confirmed.

Compliance Impact

This vulnerability involves a memory leak in the Linux kernel's USB isochronous scheduling subsystem, specifically when EHCI or FOTG210 controllers fail to process URBs. While it does not directly impact data privacy or security controls, memory leaks could lead to system instability or crashes, indirectly affecting compliance by disrupting operations that handle sensitive data under GDPR or HIPAA.

Mitigation Strategies

Apply the latest kernel patches from your Linux distribution to resolve the issue. If patches are unavailable, consider disabling EHCI and FOTG210 USB controllers if not in use. Monitor kernel logs for USB-related errors post-update. Avoid using untrusted USB devices until the kernel is patched.

Hi! I’m here to help you understand CVE-2026-64348. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70