CVE-2026-64348
Received Received - Intake

BaseFortify

Publication date: 2026-07-25

Last updated on: 2026-07-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: usb: free iso schedules on failed submit EHCI and FOTG210 isochronous submits build an ehci_iso_sched before linking the URB to the endpoint queue, and keep the staged schedule in urb->hcpriv until iso_stream_schedule() and the link helpers consume it. If the controller is no longer accessible, or usb_hcd_link_urb_to_ep() fails, submit jumps to done_not_linked before that handoff happens and leaks the staged schedule still attached to urb->hcpriv. Free the staged schedule from done_not_linked when submit fails before the URB is linked and clear urb->hcpriv after the free. The bug was first flagged by an experimental analysis tool we are developing for kernel memory-management bugs while analyzing v6.13-rc1. The tool is still under development and is not yet publicly available. Manual inspection confirms that the bug is still present in v7.1.1. An x86_64 allyesconfig build showed no new warnings. As we do not have an EHCI host controller with a USB isochronous device to test with, no runtime testing was able to be performed.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-25
Last Modified
2026-07-25
Generated
2026-07-25
AI Q&A
2026-07-25
EPSS Evaluated
N/A
NVD
CVE-2026-64348
EUVD
EUVD-2026-48892

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
linux linux_kernel From 7.1.1 (exc)
linux linux_kernel From 6.13-rc1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a memory leak in the USB subsystem. When isochronous USB submissions fail, the kernel fails to properly free a scheduled memory structure (ehci_iso_sched) attached to a URB (USB Request Block). This happens because the cleanup process jumps to a label before the scheduled schedule is properly linked and freed, leaving the memory allocated.

Detection Guidance

This vulnerability is specific to the Linux kernel's USB subsystem, particularly EHCI and FOTG210 controllers. Detection requires kernel-level inspection for memory leaks in isochronous USB submissions. Check kernel logs for errors related to usb_hcd_link_urb_to_ep() failures or memory leaks in USB drivers. Use commands like dmesg | grep -i usb or journalctl -k | grep -i usb to review USB-related errors.

Impact Analysis

This vulnerability could lead to memory exhaustion over time if many failed USB submissions occur, potentially causing system instability or crashes. It may also indicate broader memory management issues in the kernel, though no active exploitation or runtime testing has been confirmed.

Mitigation Strategies

Apply the latest kernel patches from your Linux distribution to resolve the issue. If patches are unavailable, consider disabling EHCI and FOTG210 USB controllers if not in use. Monitor kernel logs for USB-related errors post-update. Avoid using untrusted USB devices until the kernel is patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64348. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart