EUVD-2026-48875

In the Linux kernel, the following vulnerability has been resolved: usbip: vudc: fix NULL deref in vepdequeue vepallocrequest wasn't initializing vrequest-udc, so cancellations on the FunctionFS AIO path were arriving in vepdequeue without a valid UDC reference. Since vrequest-udc is never actual...

CVE-2026-64331 usbip: vudc: fix NULL deref in vep_dequeue()

In the Linux kernel, the following vulnerability has been resolved: usbip: vudc: fix NULL deref in vepdequeue vepallocrequest wasn't initializing vrequest-udc, so cancellations on the FunctionFS AIO path were arriving in vepdequeue without a valid UDC reference. Since vrequest-udc is never actual...

EUVD-2026-48873

In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove The threaded IRQ handler ccgirqhandler calls ucsinotifycommon, which on a connector-change event calls ucsiconnectorchange and schedules connector work. In ucsiccgremove...

CVE-2026-64330

CVE-2026-64330 (Linux kernel, usb: typec: tcpm) A bounds-checking flaw exists in svdm_consume_modes() where the SVID value is read from pmdata->svids[pmdata->svid_index] without validating the index. If svid_index is driven beyond SVID_DISCOVERY_MAX (16), it can read past the svids array in...

CVE-2026-64330 usb: typec: tcpm: Validate SVID index in svdm_consume_modes()

In the Linux kernel, the following vulnerability has been resolved: usb: typec: tcpm: Validate SVID index in svdmconsumemodes In svdmconsumemodes, the SVID value is read from pmdata-svids using pmdata-svidindex as an array index without bounds validation: paltmode-svid =...

CVE-2026-64329 usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove

In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove The threaded IRQ handler ccgirqhandler calls ucsinotifycommon, which on a connector-change event calls ucsiconnectorchange and schedules connector work. In ucsiccgremove...

CVE-2026-64329 usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove

In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove The threaded IRQ handler ccgirqhandler calls ucsinotifycommon, which on a connector-change event calls ucsiconnectorchange and schedules connector work. In ucsiccgremove...

CVE-2026-64329

CVE-2026-64329 concerns the Linux kernel USB Type-C UCSI CC G use-after-free on remove. The bug is caused by freeing uc->ucsi (kfree) in ucsi_ccg_remove() after the threaded IRQ handler may still access it via ucsi_notify_common() during a connector-change event, leading to a potential use-aft...

CVE-2026-64328 usb: gadget: f_fs: Fix DMA fence leak

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ffs: Fix DMA fence leak In ffsdmabuftransfer, a ffsdmafence object is kmalloc'd, with the underlying dmafence later initialized by dmafenceinit, which sets its kref counter to 1. Then, dmaresvaddfence gets a second...

CVE-2026-64328

CVE-2026-64328 : The issue affects the Linux kernel in the usb: gadget: f_fs path, specifically the ffs_dmabuf_transfer() flow. A ffs_dma_fence object is kmalloc’d, then dma_fence_init() creates a second reference via dma_resv_add_fence(), while the first reference is not released, causing a memo...

EUVD-2026-48872

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ffs: Fix DMA fence leak In ffsdmabuftransfer, a ffsdmafence object is kmalloc'd, with the underlying dmafence later initialized by dmafenceinit, which sets its kref counter to 1. Then, dmaresvaddfence gets a second...

CVE-2026-64327

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ffs: Initialize epfile-in early to fix endpoint direction checks When parsing endpoint descriptors, ffsdatagotdescs generates the epsaddrmap which contains the endpoint direction. However, epfile-in was previously on...

CVE-2026-64327 usb: gadget: f_fs: Initialize epfile->in early to fix endpoint direction checks

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ffs: Initialize epfile-in early to fix endpoint direction checks When parsing endpoint descriptors, ffsdatagotdescs generates the epsaddrmap which contains the endpoint direction. However, epfile-in was previously on...

CVE-2026-64327 usb: gadget: f_fs: Initialize epfile->in early to fix endpoint direction checks

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ffs: Initialize epfile-in early to fix endpoint direction checks When parsing endpoint descriptors, ffsdatagotdescs generates the epsaddrmap which contains the endpoint direction. However, epfile-in was previously on...

SUSE CVE-2026-64233

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: uvc: hold opts-lock across XU walks in uvcfunctionbind uvcfunctionbind walks &opts-extensionunits twice without holding opts-lock: - directly, for the iExtension string-descriptor fixup loop; - indirectly, four times...

PT-2026-64726

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: function: rndis: add length check for header Add a length check for the rndis header in rndis rm hdr, to ensure that MessageType, MessageLength, DataOffset, and DataLength fields are present before they are accessed...

PT-2026-64561

In the Linux kernel, the following vulnerability has been resolved: USB: legousbtower: fix use-after-free on disconnect race mutex unlock may access the mutex structure after releasing the lock and therefore cannot be used to manage lifetime of objects directly unlike spinlocks and refcounts. 12...

PT-2026-64684

In the Linux kernel, the following vulnerability has been resolved: usb: typec: tcpci rt1711h: unregister TCPCI port with devres rt1711h probe registers the TCPCI port before requesting the interrupt and enabling alert interrupts. If either of those later steps fails, the probe function returns...

PT-2026-64570

In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: fix dwc3 readl and dwc3 writel calls in dwc3 ulpi setup The dwc3 ulpi setup calls the register read and write calls with dwc3-regs when both these calls take the dwc3 structure directly. Chnage these two calls to fix t...

Linux Distros Unpatched Vulnerability : CVE-2026-64478

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ALSA: usb-audio: avoid kobject path lookup in DualSense match The DualSense jack-detection input handler verifies that a matching input device belongs to the sa...