CVE-2026-64350

CVE-2026-64350 is a memory leak in the Linux kernel's USB CDNSP driver . The function cdnsp_alloc_stream_info() allocates a stream_ctx_array via cdnsp_alloc_stream_ctx(), but if a subsequent stream ring allocation or stream mapping update fails, the error path frees the stream rings and stream_ri...

EUVD-2026-48893

In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: fix dwc3readl and dwc3writel calls in dwc3ulpisetup The dwc3ulpisetup calls the register read and write calls with dwc3-regs when both these calls take the dwc3 structure directly. Chnage these two calls to fix the...

CVE-2026-64349 usb: dwc3: fix dwc3_readl() and dwc3_writel() calls in dwc3_ulpi_setup()

In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: fix dwc3readl and dwc3writel calls in dwc3ulpisetup The dwc3ulpisetup calls the register read and write calls with dwc3-regs when both these calls take the dwc3 structure directly. Chnage these two calls to fix the...

CVE-2026-64349

CVE-2026-64349 affects the DesignWare USB3 (dwc3) driver in the Linux kernel . In dwc3_ulpi_setup() (drivers/usb/dwc3/core.c), the functions dwc3_readl() and dwc3_writel() are incorrectly passed dwc3->regs (a void __iomem *) instead of the expected struct dwc3 * pointer. This type mismatch acr...

EUVD-2026-48892

In the Linux kernel, the following vulnerability has been resolved: usb: free iso schedules on failed submit EHCI and FOTG210 isochronous submits build an ehciisosched before linking the URB to the endpoint queue, and keep the staged schedule in urb-hcpriv until isostreamschedule and the link...

EUVD-2026-48891

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: composite: fix dead empty check in the USBDTOTG handler The OTG branch of compositesetup falls back to the first configuration when none is selected: if cdev-config config = cdev-config; else config =...

CVE-2026-64348 usb: free iso schedules on failed submit

In the Linux kernel, the following vulnerability has been resolved: usb: free iso schedules on failed submit EHCI and FOTG210 isochronous submits build an ehciisosched before linking the URB to the endpoint queue, and keep the staged schedule in urb-hcpriv until isostreamschedule and the link...

CVE-2026-64347 usb: gadget: composite: fix dead empty check in the USB_DT_OTG handler

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: composite: fix dead empty check in the USBDTOTG handler The OTG branch of compositesetup falls back to the first configuration when none is selected: if cdev-config config = cdev-config; else config =...

CVE-2026-64348

CVE-2026-64348 is a memory leak in the Linux kernel's USB subsystem affecting EHCI and FOTG210 isochronous submit paths. When usb_hcd_link_urb_to_ep() fails or the controller becomes inaccessible, the staged ehci_iso_sched is leaked on urb->hcpriv because the done_not_linked error path skips t...

CVE-2026-64347

CVE-2026-64347 affects the Linux kernel USB gadget composite driver (composite_setup() OTG handler). The root cause is a dead empty check : list_first_entry() never returns NULL on an empty list, so the if (!config) guard is ineffective. When cdev->configs is empty—triggered by a teardown race...

CVE-2026-64347 usb: gadget: composite: fix dead empty check in the USB_DT_OTG handler

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: composite: fix dead empty check in the USBDTOTG handler The OTG branch of compositesetup falls back to the first configuration when none is selected: if cdev-config config = cdev-config; else config =...

CVE-2026-64348 usb: free iso schedules on failed submit

In the Linux kernel, the following vulnerability has been resolved: usb: free iso schedules on failed submit EHCI and FOTG210 isochronous submits build an ehciisosched before linking the URB to the endpoint queue, and keep the staged schedule in urb-hcpriv until isostreamschedule and the link...

EUVD-2026-48889

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fprinter: take kref only for successful open printeropen returns -EBUSY when the character device is already open, but it increments dev-kref regardless of the return value. VFS does not call -release for a failed...

CVE-2026-64346

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: udc: Fix use-after-free in gadgetmatchdriver The udc structure acts as the management structure for the gadget, but their lifecycles are decoupled. A race condition exists where usbdelgadget frees the udc memory e.g....

CVE-2026-64345

CVE-2026-64345 affects the Linux kernel USB gadget f_printer driver. The function printer_open() increments dev->kref even when it returns -EBUSY (device already open). Because VFS does not call ->release() for a failed open, every rejected second open permanently leaks one reference count ...

EUVD-2026-48890

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: udc: Fix use-after-free in gadgetmatchdriver The udc structure acts as the management structure for the gadget, but their lifecycles are decoupled. A race condition exists where usbdelgadget frees the udc memory e.g....

CVE-2026-64345 usb: gadget: f_printer: take kref only for successful open

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fprinter: take kref only for successful open printeropen returns -EBUSY when the character device is already open, but it increments dev-kref regardless of the return value. VFS does not call -release for a failed...

CVE-2026-64346 usb: gadget: udc: Fix use-after-free in gadget_match_driver

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: udc: Fix use-after-free in gadgetmatchdriver The udc structure acts as the management structure for the gadget, but their lifecycles are decoupled. A race condition exists where usbdelgadget frees the udc memory e.g....

CVE-2026-64345 usb: gadget: f_printer: take kref only for successful open

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fprinter: take kref only for successful open printeropen returns -EBUSY when the character device is already open, but it increments dev-kref regardless of the return value. VFS does not call -release for a failed...

CVE-2026-64346

CVE-2026-64346 is a Use-After-Free (UAF) in the Linux kernel's USB gadget UDC subsystem. A race condition allows usb_del_gadget() to free the udc management structure (e.g., via a mode-switch workqueue) while gadget_match_driver() concurrently accesses it through configfs, triggering a NULL point...