PT-2026-64558 · Linux · Linux

CVE-2026-64337 · Published 2026-07-25 · Updated 2026-07-25

NVD

In the Linux kernel, the following vulnerability has been resolved:

usb: mtu3: unmap request DMA on queue failure

mtu3 gadget queue() maps the request before checking whether the QMU GPD ring can accept another transfer. the request is returned with -EAGAIN before it is linked on the endpoint request list if mtu3 prepare transfer() fails.

Normal completion and dequeue paths unmap requests from mtu3 req complete(), but this error path never reaches that helper, so the DMA mapping is left active. Unmap the request before returning from the failed queue path.

Related Identifiers

CVE-2026-64337

Affected Products

Linux

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2026-64337 · Security Note
• https://git.kernel.org/stable/c/0bddda5a11665c210339de76d27ebbd1a2e0b43c · Note
• https://git.kernel.org/stable/c/835b0596d4c9bdef93f842d8f826978fb4956b74 · Note
• https://git.kernel.org/stable/c/4183874b7925f4a98b400cf857bea26ee87da236 · Note
• https://git.kernel.org/stable/c/e8f739a3860d043dcc135371637e82f53132efe5 · Note
• https://git.kernel.org/stable/c/00c3fef4c2dc2c7cbd8281f8fda09d1913420f09 · Note
• https://git.kernel.org/stable/c/3cee30f1138281a1d247bb053a1ad4f7c5b04e98 · Note
• https://git.kernel.org/stable/c/8c29d9cfab1c3cf0d0b7fcdf9255597be30aa3e1 · Note
• https://git.kernel.org/stable/c/f3c4026524d3660c73ef2838b99776d37631e039 · Note