PT-2026-64569 · Linux · Linux
CVE-2026-64348
·
Published
2026-07-25
·
Updated
2026-07-25
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
usb: free iso schedules on failed submit
EHCI and FOTG210 isochronous submits build an ehci iso sched before
linking the URB to the endpoint queue, and keep the staged schedule in
urb->hcpriv until iso stream schedule() and the link helpers consume it.
If the controller is no longer accessible, or usb hcd link urb to ep()
fails, submit jumps to done not linked before that handoff happens and
leaks the staged schedule still attached to urb->hcpriv.
Free the staged schedule from done not linked when submit fails before
the URB is linked and clear urb->hcpriv after the free.
The bug was first flagged by an experimental analysis tool we are
developing for kernel memory-management bugs while analyzing
v6.13-rc1. The tool is still under development and is not yet publicly
available. Manual inspection confirms that the bug is still
present in v7.1.1.
An x86 64 allyesconfig build showed no new warnings. As we do not have an
EHCI host controller with a USB isochronous device to test with, no
runtime testing was able to be performed.
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux