PT-2026-64355 · Linux · Linux

CVE-2026-64240 · Published 2026-07-24 · Updated 2026-07-24

NVD

In the Linux kernel, the following vulnerability has been resolved:

media: rc: igorplugusb: fix control request setup packet

Commit eac69475b01f ("media: rc: igorplugusb: heed coherency rules") changed the control request storage from an embedded struct to an allocated pointer so it can obey DMA coherency rules.

However, the driver still passes &ir->request to usb fill control urb(). That points the URB setup packet at the pointer field itself rather than at the allocated struct usb ctrlrequest.

USB core then interprets pointer bytes as the setup packet. This can produce an invalid bRequestType and trigger the control direction warning reported by syzbot:

usb 2-1: BOGUS control dir, pipe 80003580 doesn't match bRequestType 0

Pass ir->request itself as the setup packet.

Related Identifiers

CVE-2026-64240

Affected Products

Linux

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2026-64240 · Security Note
• https://git.kernel.org/stable/c/060fca8e098387f949e4eedaf215d952e477ac12 · Note
• https://git.kernel.org/stable/c/5cc3f6db72f77d1a8f7f1cf4ac01803927ffdf15 · Note
• https://git.kernel.org/stable/c/171022c7d594c133a45f92357a2a91475edabe20 · Note
• https://git.kernel.org/stable/c/aa22590a16e51455c6db802c774b31aadc604a9a · Note
• https://git.kernel.org/stable/c/0d880d2db9856e94127ab09331363bef59f98005 · Note
• https://git.kernel.org/stable/c/f33b5a61673bd220fdaaf4202cf1013d6d66c943 · Note
• https://git.kernel.org/stable/c/e823e4294511989f5962e7ad85bf4d179ba74f52 · Note
• https://git.kernel.org/stable/c/2243ad78ce64d344754260533ae7730c2174a34a · Note