CVE-2026-64339

CVE-2026-64339 affects the Linux kernel USB IO stack (usbio_bulk_msg). A malicious device that advertises a large bulk OUT and small bulk IN endpoint can set bpkt_len (from bpkt->len) to exceed rxbuf_len, causing memcpy to read past rxbuf and leak adjacent slab memory via i2c-dev. The code alr...

EUVD-2026-48884

In the Linux kernel, the following vulnerability has been resolved: USB: legousbtower: fix use-after-free on disconnect race mutexunlock may access the mutex structure after releasing the lock and therefore cannot be used to manage lifetime of objects directly unlike spinlocks and refcounts. 12 U...

CVE-2026-64338

CVE-2026-64338 concerns the Linux kernel USB subsystem, specifically the uss720 driver. The issue arises when uss720_probe() registers a parport before reading the 1284 register used to detect Belkin F5U002 adapters. If get_1284_register() fails, the error path currently drops the driver private ...

CVE-2026-64337

CVE-2026-64337 (Linux kernel): usb mtu3 flaw where mtu3_gadget_queue() maps the request before verifying QMU GPD space, causing a DMA mapping to remain active if mtu3_prepare_transfer() fails and the request isn’t linked. The fix unmaps the DMA on the failed queue path before returning. Documents...

CVE-2026-64337 usb: mtu3: unmap request DMA on queue failure

In the Linux kernel, the following vulnerability has been resolved: usb: mtu3: unmap request DMA on queue failure mtu3gadgetqueue maps the request before checking whether the QMU GPD ring can accept another transfer. the request is returned with -EAGAIN before it is linked on the endpoint request...

EUVD-2026-48881

In the Linux kernel, the following vulnerability has been resolved: usb: mtu3: unmap request DMA on queue failure mtu3gadgetqueue maps the request before checking whether the QMU GPD ring can accept another transfer. the request is returned with -EAGAIN before it is linked on the endpoint request...

EUVD-2026-48882

In the Linux kernel, the following vulnerability has been resolved: USB: misc: uss720: unregister parport on probe failure uss720probe registers a parport before reading the 1284 register used to detect unsupported Belkin F5U002 adapters. If get1284register fails, the error path drops the driver...

EUVD-2026-48880

In the Linux kernel, the following vulnerability has been resolved: USB: serial: keyspanpda: fix information leak The write callback is supposed to return the number of characters accepted or a negative errno. Since the addition of write fifo support the keyspanpda implementation will however...

CVE-2026-64336

CVE-2026-64336 affects the Linux kernel USB serial driver keyspan_pda. The information leak arose because the write() callback could report the number of characters submitted to the device when a write URB wasn’t in use, allowing data beyond the tty write buffer to be written. The root cause is t...

CVE-2026-64336 USB: serial: keyspan_pda: fix information leak

In the Linux kernel, the following vulnerability has been resolved: USB: serial: keyspanpda: fix information leak The write callback is supposed to return the number of characters accepted or a negative errno. Since the addition of write fifo support the keyspanpda implementation will however...

CVE-2026-64334 USB: serial: digi_acceleport: fix hard lockup on disconnect

In the Linux kernel, the following vulnerability has been resolved: USB: serial: digiacceleport: fix hard lockup on disconnect If submitting the OOB write urb fails persistently e.g if the device is being disconnected the driver would loop indefinitely with interrupts disabled. Check for urb...

CVE-2026-64335

The CVE-2026-64335 entry describes a Linux kernel issue in the USB serial digi_acceleport driver. If a port is closed while throttled, the read URB is not resubmitted, causing the port to stop receiving data until reconnection or driver rebound. The documented fix clears throttle flags and resubm...

CVE-2026-64334

The CVE-2026-64334 entry relates to the Linux kernel USB serial driver for digi_acceleport. Root cause: when submitting OOB write URBs fails persistently during a device disconnect, the driver could loop with interrupts disabled, causing a hard lockup. The fix adds checks for URB submission error...

CVE-2026-64332 USB: ulpi: fix memory leak on registration failure

In the Linux kernel, the following vulnerability has been resolved: USB: ulpi: fix memory leak on registration failure The allocated device name is never freed on early ULPI device registration failures. Fix this by initialising the device structure earlier and releasing the initial reference...

EUVD-2026-48876

In the Linux kernel, the following vulnerability has been resolved: USB: ulpi: fix memory leak on registration failure The allocated device name is never freed on early ULPI device registration failures. Fix this by initialising the device structure earlier and releasing the initial reference...

CVE-2026-64332

The CVE-2026-64332 entry describes a Linux kernel vulnerability in the USB: ulpi driver where a memory leak occurs when registration fails. The root cause is that the allocated device name is not freed on early ULPI device registration failures. The remediation is to initialize the device structu...

EUVD-2026-48877

In the Linux kernel, the following vulnerability has been resolved: USB: serial: digiacceleport: fix write buffer corruption The digiwriteinbcommand is supposed to wait for the write urb to become available or return an error, but instead it updates the transfer buffer and tries to resubmit the u...

CVE-2026-64333 USB: serial: digi_acceleport: fix write buffer corruption

In the Linux kernel, the following vulnerability has been resolved: USB: serial: digiacceleport: fix write buffer corruption The digiwriteinbcommand is supposed to wait for the write urb to become available or return an error, but instead it updates the transfer buffer and tries to resubmit the u...

CVE-2026-64333

The CVE-2026-64333 issue affects the Linux kernel USB serial driver digi_acceleport. The vulnerability was caused by digi_write_inb_command() not properly handling timeouts: it could update the transfer buffer and resubmit the URB on timeout, and for break-control type commands with no timeout it...

CVE-2026-64331

The CVE-2026-64331 vulnerability in the Linux kernel affects usbip vudc: vep_dequeue() could dereference a NULL UDC reference due to vep_alloc_request() not initializing vrequest->udc. The fix removes vrequest->udc and uses ep_to_vudc() to obtain the UDC reference consistently across vep op...