CVE-2026-64349
Received Received - Intake

BaseFortify

Publication date: 2026-07-25

Last updated on: 2026-07-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: fix dwc3_readl() and dwc3_writel() calls in dwc3_ulpi_setup() The dwc3_ulpi_setup() calls the register read and write calls with dwc3->regs when both these calls take the dwc3 structure directly. Chnage these two calls to fix the following sparse warning, and possibly a nasty bug in the dwc3_ulpi_setup() code: drivers/usb/dwc3/core.c:796:45: warning: incorrect type in argument 1 (different address spaces) drivers/usb/dwc3/core.c:796:45: expected struct dwc3 *dwc drivers/usb/dwc3/core.c:796:45: got void [noderef] __iomem *regs drivers/usb/dwc3/core.c:798:40: warning: incorrect type in argument 1 (different address spaces) drivers/usb/dwc3/core.c:798:40: expected struct dwc3 *dwc drivers/usb/dwc3/core.c:798:40: got void [noderef] __iomem *regs

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-25
Last Modified
2026-07-25
Generated
2026-07-25
AI Q&A
2026-07-25
EPSS Evaluated
N/A
NVD
CVE-2026-64349
EUVD
EUVD-2026-48893

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves incorrect function calls in the dwc3_ulpi_setup() function. The issue occurs when dwc3_readl() and dwc3_writel() are called with dwc3->regs instead of the dwc3 structure directly. This causes a type mismatch, leading to sparse warnings and potential bugs due to different address spaces.

Detection Guidance

This vulnerability is specific to the Linux kernel's dwc3 USB driver and does not have network-based detection methods. To detect it, check if your system is running a vulnerable kernel version by examining the kernel version and the presence of the affected code in the dwc3 driver. Use commands like 'uname -a' to check the kernel version and 'modinfo dwc3' to inspect the driver module.

Impact Analysis

This vulnerability may cause system instability or crashes in systems using the affected Linux kernel component. It could lead to improper USB functionality or data corruption if the dwc3_ulpi_setup() function fails to operate correctly.

Mitigation Strategies

Apply the latest kernel update provided by your Linux distribution to patch the vulnerability. If an update is not immediately available, consider disabling the dwc3 USB driver if it is not required. Monitor vendor advisories for patches and updates.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64349. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart