CVE-2026-64349

Awaiting Analysis Awaiting Analysis - Queue

Memory Corruption in Linux Kernel USB DWC3 Driver

Publication date: 2026-07-25

Last updated on: 2026-08-11

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: fix dwc3_readl() and dwc3_writel() calls in dwc3_ulpi_setup() The dwc3_ulpi_setup() calls the register read and write calls with dwc3->regs when both these calls take the dwc3 structure directly. Chnage these two calls to fix the following sparse warning, and possibly a nasty bug in the dwc3_ulpi_setup() code: drivers/usb/dwc3/core.c:796:45: warning: incorrect type in argument 1 (different address spaces) drivers/usb/dwc3/core.c:796:45: expected struct dwc3 *dwc drivers/usb/dwc3/core.c:796:45: got void [noderef] __iomem *regs drivers/usb/dwc3/core.c:798:40: warning: incorrect type in argument 1 (different address spaces) drivers/usb/dwc3/core.c:798:40: expected struct dwc3 *dwc drivers/usb/dwc3/core.c:798:40: got void [noderef] __iomem *regs

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-25

Last Modified

2026-08-11

Generated

2026-08-14

AI Q&A

2026-07-25

EPSS Evaluated

2026-08-13

NVD

CVE-2026-64349

EUVD

EUVD-2026-48893

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves incorrect function calls in the dwc3_ulpi_setup() function. The issue occurs when dwc3_readl() and dwc3_writel() are called with dwc3->regs instead of the dwc3 structure directly. This causes a type mismatch, leading to sparse warnings and potential bugs due to different address spaces.

Detection Guidance

This vulnerability is specific to the Linux kernel's dwc3 USB driver and does not have network-based detection methods. To detect it, check if your system is running a vulnerable kernel version by examining the kernel version and the presence of the affected code in the dwc3 driver. Use commands like 'uname -a' to check the kernel version and 'modinfo dwc3' to inspect the driver module.

Impact Analysis

This vulnerability may cause system instability or crashes in systems using the affected Linux kernel component. It could lead to improper USB functionality or data corruption if the dwc3_ulpi_setup() function fails to operate correctly.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it is a low-level kernel issue related to sparse warnings and type mismatches in the dwc3_ulpi_setup() function. No data exposure or security impact is described.

Mitigation Strategies

Apply the latest kernel update provided by your Linux distribution to patch the vulnerability. If an update is not immediately available, consider disabling the dwc3 USB driver if it is not required. Monitor vendor advisories for patches and updates.

Hi! I’m here to help you understand CVE-2026-64349. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70