PT-2026-64355 · Linux · Linux

CVE-2026-64240 · Publicado 2026-07-24 · Atualizado 2026-07-24

NVD

In the Linux kernel, the following vulnerability has been resolved:

media: rc: igorplugusb: fix control request setup packet

Commit eac69475b01f ("media: rc: igorplugusb: heed coherency rules") changed the control request storage from an embedded struct to an allocated pointer so it can obey DMA coherency rules.

However, the driver still passes &ir->request to usb fill control urb(). That points the URB setup packet at the pointer field itself rather than at the allocated struct usb ctrlrequest.

USB core then interprets pointer bytes as the setup packet. This can produce an invalid bRequestType and trigger the control direction warning reported by syzbot:

usb 2-1: BOGUS control dir, pipe 80003580 doesn't match bRequestType 0

Pass ir->request itself as the setup packet.

Identificadores relacionados

CVE-2026-64240

Produtos afetados

Linux

Referências · 9

• https://git.kernel.org/stable/c/060fca8e098387f949e4eedaf215d952e477ac12 · Nota
• https://git.kernel.org/stable/c/5cc3f6db72f77d1a8f7f1cf4ac01803927ffdf15 · Nota
• https://git.kernel.org/stable/c/171022c7d594c133a45f92357a2a91475edabe20 · Nota
• https://git.kernel.org/stable/c/aa22590a16e51455c6db802c774b31aadc604a9a · Nota
• https://git.kernel.org/stable/c/0d880d2db9856e94127ab09331363bef59f98005 · Nota
• https://git.kernel.org/stable/c/f33b5a61673bd220fdaaf4202cf1013d6d66c943 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-64240 · Nota de Segurança
• https://git.kernel.org/stable/c/e823e4294511989f5962e7ad85bf4d179ba74f52 · Nota
• https://git.kernel.org/stable/c/2243ad78ce64d344754260533ae7730c2174a34a · Nota