EUVD-2025-206534

Improper link resolution in USB HTTP access path in VX800v v1.0 allows a crafted USB device to expose root filesystem contents, giving an attacker with physical access read‑only access to system files...

PT-2026-5322

Name of the Vulnerable Software and Affected Versions VX800v version 1.0 Description A flaw exists in the USB HTTP access path that results in improper link resolution. This allows a specially crafted USB device to reveal the root filesystem contents, granting an attacker with physical access...

CVE-2025-55095

The function uxhostclassstoragemediamount is responsible for mounting partitions on a USB mass storage device. When it encounters an extended partition entry in the partition table, it recursively calls itself to mount the next logical partition. This recursion occurs in...

kernel: media: rc: fix races with imon_disconnect()

A use-after-free flaw exists in the Linux kernel’s media/rc subsystem. When the device is disconnected via imondisconnect, the driver may unconditionally release a usbdevice reference via usbputdev even while other operations such as vfdwrite, sendpacket, displayopen, lcdwrite are still in...

ROS-20260128-73-0013

A vulnerability in the drivers/usb/gadget/function/uaudio.c module of the Linux operating system kernel is related to file descriptor depletion. Exploitation of the vulnerability could allow an attacker to cause a denial of service...

ROS-20260128-73-0021

A vulnerability in the drivers/usb/dwc2/platform.c module of the Linux operating system kernel is related to a memory leak. Exploitation of the vulnerability could allow an attacker to cause a denial of service...

SUSE CVE-2025-71154

In the Linux kernel, the following vulnerability has been resolved: net: usb: rtl8150: fix memory leak on usbsubmiturb failure In asyncsetregisters, when usbsubmiturb fails, the allocated asyncreq structure and URB are not freed, causing a memory leak. The completion callback asyncsetregcb is...

CVE-2025-71154 net: usb: rtl8150: fix memory leak on usb_submit_urb() failure

In the Linux kernel, the following vulnerability has been resolved: net: usb: rtl8150: fix memory leak on usbsubmiturb failure In asyncsetregisters, when usbsubmiturb fails, the allocated asyncreq structure and URB are not freed, causing a memory leak. The completion callback asyncsetregcb is...

CVE-2025-71154

In the Linux kernel, the following vulnerability has been resolved: net: usb: rtl8150: fix memory leak on usbsubmiturb failure In asyncsetregisters, when usbsubmiturb fails, the allocated asyncreq structure and URB are not freed, causing a memory leak. The completion callback asyncsetregcb is...

CVE-2025-71145

In the Linux kernel, the following vulnerability has been resolved: usb: phy: isp1301: fix non-OF device reference imbalance A recent change fixing a device reference leak in a UDC driver introduced a potential use-after-free in the non-OF case as the isp1301getclient helper only increases the...

The vulnerability of the fsl_otgremove() function in the drivers/usb/phy/phy-fsl-usb.c module of the Linux kernel allows a hacker to gain increased privileges.

The vulnerability of the fslotgremove function in the drivers/usb/phy/phy-fsl-usb.c module of the Linux kernel relates to the possibility of using memory after it is freed. Exploiting this vulnerability could allow an attacker to gain increased privileges...

PT-2026-4357

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw exists in the Linux kernel related to a device reference imbalance within the ISP1301 USB PHY driver. A recent fix for a device reference leak in a UDC driver introduced a potenti...

Azure Linux 3.0 Security Update: kernel (CVE-2025-21776)

The version of kernel installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-21776 advisory. - In the Linux kernel, the following vulnerability has been resolved: USB: hub: Ignore non-compliant devices...

Azure Linux 3.0 Security Update: kernel (CVE-2025-37985)

The version of kernel installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-37985 advisory. - In the Linux kernel, the following vulnerability has been resolved: USB: wdm: close race between wdmopen and...

The vulnerability of the client for USB devices in the URBDRC RDP-client FreeRDP system allows a perpetrator to execute arbitrary code or trigger a service failure.

The vulnerability of the URBDRC RDP-client-freeRDP device lies in unvalidated array indexing. Exploiting this vulnerability could allow an attacker to execute arbitrary code or cause service failures...

ROS-20260120-7330

A vulnerability in the usbfindcommonendpoints function of the USB driver drivers/usb/atm/cxacru.c of the Linux kernel is related to insufficient input validation during endpoint processing. Exploitation of the vulnerability could allow an attacker to cause a denial of service...

ROS-20260120-7331

A vulnerability in the usbhscnotifyhotplug function of the USB driver drivers/usb/renesasusbhs/common.c of the Linux kernel is related to pointer dereferencing. Exploitation of the vulnerability could allow an attacker to cause a denial of service...

kernel: usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths

A use-after-free vulnerability was found in the DWC3 USB controller driver in the Linux kernel. Multiple unsynchronized execution paths can invoke dwc3removerequests concurrently, leading to premature freeing of USB requests. When one path frees requests while another is still processing them, a...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-001058)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-001058 advisory. The hubactivate function in drivers/usb/core/hub.c in the Linux kernel before 4.3.5 does not properly maintain a hub-interface data structure, which allows physicall...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-001637)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-001637 advisory. drivers/uwb/uwbd.c in the Linux kernel before 4.13.6 allows local users to cause a denial of service general protection fault and system crash or possibly have...