{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-64348", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-19T15:36:31.782Z", "datePublished": "2026-07-25T08:50:08.983Z", "dateUpdated": "2026-08-17T04:53:53.432Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-17T04:53:53.432Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: free iso schedules on failed submit\n\nEHCI and FOTG210 isochronous submits build an ehci_iso_sched before\nlinking the URB to the endpoint queue, and keep the staged schedule in\nurb->hcpriv until iso_stream_schedule() and the link helpers consume it.\nIf the controller is no longer accessible, or usb_hcd_link_urb_to_ep()\nfails, submit jumps to done_not_linked before that handoff happens and\nleaks the staged schedule still attached to urb->hcpriv.\n\nFree the staged schedule from done_not_linked when submit fails before\nthe URB is linked and clear urb->hcpriv after the free.\n\nThe bug was first flagged by an experimental analysis tool we are\ndeveloping for kernel memory-management bugs while analyzing\nv6.13-rc1. The tool is still under development and is not yet publicly\navailable. Manual inspection confirms that the bug is still\npresent in v7.1.1.\n\nAn x86_64 allyesconfig build showed no new warnings. As we do not have an\nEHCI host controller with a USB isochronous device to test with, no\nruntime testing was able to be performed."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/usb/fotg210/fotg210-hcd.c", "drivers/usb/host/ehci-sched.c"], "versions": [{"version": "8de98402652c01839ae321be6cb3054cf5735d83", "lessThan": "b0d00d077f9738d215af9b50c74dffab7a1de19f", "status": "affected", "versionType": "git"}, {"version": "8de98402652c01839ae321be6cb3054cf5735d83", "lessThan": "be5004395dfd0b6ec310db359f887fa396fd0dd2", "status": "affected", "versionType": "git"}, {"version": "8de98402652c01839ae321be6cb3054cf5735d83", "lessThan": "8890699eea19027ef6e4f9cbcf27cba5e789793f", "status": "affected", "versionType": "git"}, {"version": "8de98402652c01839ae321be6cb3054cf5735d83", "lessThan": "6bc17a78a05671d303820224fb37ca339c1dc2cb", "status": "affected", "versionType": "git"}, {"version": "8de98402652c01839ae321be6cb3054cf5735d83", "lessThan": "4bb88aee6b868cbf73bf453f62497802f5fe4769", "status": "affected", "versionType": "git"}, {"version": "8de98402652c01839ae321be6cb3054cf5735d83", "lessThan": "b9399d25fbb34a05bbe76eeedd730f62ff2670e9", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/usb/fotg210/fotg210-hcd.c", "drivers/usb/host/ehci-sched.c"], "versions": [{"version": "2.6.15", "status": "affected"}, {"version": "0", "lessThan": "2.6.15", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.261", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.145", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.96", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.39", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.4", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.15", "versionEndExcluding": "5.10.261"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.15", "versionEndExcluding": "6.6.145"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.15", "versionEndExcluding": "6.12.96"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.15", "versionEndExcluding": "6.18.39"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.15", "versionEndExcluding": "7.1.4"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.15", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/b0d00d077f9738d215af9b50c74dffab7a1de19f"}, {"url": "https://git.kernel.org/stable/c/be5004395dfd0b6ec310db359f887fa396fd0dd2"}, {"url": "https://git.kernel.org/stable/c/8890699eea19027ef6e4f9cbcf27cba5e789793f"}, {"url": "https://git.kernel.org/stable/c/6bc17a78a05671d303820224fb37ca339c1dc2cb"}, {"url": "https://git.kernel.org/stable/c/4bb88aee6b868cbf73bf453f62497802f5fe4769"}, {"url": "https://git.kernel.org/stable/c/b9399d25fbb34a05bbe76eeedd730f62ff2670e9"}], "title": "usb: free iso schedules on failed submit", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/usb/fotg210/fotg210-hcd.c", "drivers/usb/host/ehci-sched.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "b0d00d077f9738d215af9b50c74dffab7a1de19f", "status": "affected", "version": "8de98402652c01839ae321be6cb3054cf5735d83", "versionType": "git"}, {"lessThan": "be5004395dfd0b6ec310db359f887fa396fd0dd2", "status": "affected", "version": "8de98402652c01839ae321be6cb3054cf5735d83", "versionType": "git"}, {"lessThan": "8890699eea19027ef6e4f9cbcf27cba5e789793f", "status": "affected", "version": "8de98402652c01839ae321be6cb3054cf5735d83", "versionType": "git"}, {"lessThan": "6bc17a78a05671d303820224fb37ca339c1dc2cb", "status": "affected", "version": "8de98402652c01839ae321be6cb3054cf5735d83", "versionType": "git"}, {"lessThan": "4bb88aee6b868cbf73bf453f62497802f5fe4769", "status": "affected", "version": "8de98402652c01839ae321be6cb3054cf5735d83", "versionType": "git"}, {"lessThan": "b9399d25fbb34a05bbe76eeedd730f62ff2670e9", "status": "affected", "version": "8de98402652c01839ae321be6cb3054cf5735d83", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/usb/fotg210/fotg210-hcd.c", "drivers/usb/host/ehci-sched.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "2.6.15"}, {"lessThan": "2.6.15", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.261", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.145", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.96", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.39", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.4", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "00AF9AA6-CEBA-4198-A7F6-298DA167062C", "versionEndExcluding": "5.10.261", "versionStartIncluding": "2.6.15.1", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "CA9CEC46-431F-4DB2-AFC6-D1CE68AD27CA", "versionEndExcluding": "6.6.145", "versionStartIncluding": "5.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "38A8100E-2B1A-462F-AEE9-8901B870FEF2", "versionEndExcluding": "6.12.96", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "914AE4BC-3D59-4C5A-9DB5-9CE327B429F7", "versionEndExcluding": "6.18.39", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "6228DDD6-4557-4AA3-9F43-AB995D471E42", "versionEndExcluding": "7.1.4", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:2.6.15:-:*:*:*:*:*:*", "matchCriteriaId": "C7623CAC-67FF-477D-9F80-F383014C82DC", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:2.6.15:rc4:*:*:*:*:*:*", "matchCriteriaId": "A89DC9CD-C06F-4B9B-B376-900E65016296", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:2.6.15:rc5:*:*:*:*:*:*", "matchCriteriaId": "15BED7A7-3E96-43EF-8B6F-3C94897C3AA1", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:2.6.15:rc6:*:*:*:*:*:*", "matchCriteriaId": "8C6FCAC4-B6C6-4125-B3AC-F30407AA7738", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:2.6.15:rc7:*:*:*:*:*:*", "matchCriteriaId": "707ECC75-65B6-4B02-BE85-A4804549A2DD", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.2:rc1:*:*:*:*:*:*", "matchCriteriaId": "5E8B9085-7ADB-4A05-89EF-12949B6A0509", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.2:rc2:*:*:*:*:*:*", "matchCriteriaId": "1FC0D50D-9D58-4947-A197-A5A3FF07E7E3", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: free iso schedules on failed submit\n\nEHCI and FOTG210 isochronous submits build an ehci_iso_sched before\nlinking the URB to the endpoint queue, and keep the staged schedule in\nurb->hcpriv until iso_stream_schedule() and the link helpers consume it.\nIf the controller is no longer accessible, or usb_hcd_link_urb_to_ep()\nfails, submit jumps to done_not_linked before that handoff happens and\nleaks the staged schedule still attached to urb->hcpriv.\n\nFree the staged schedule from done_not_linked when submit fails before\nthe URB is linked and clear urb->hcpriv after the free.\n\nThe bug was first flagged by an experimental analysis tool we are\ndeveloping for kernel memory-management bugs while analyzing\nv6.13-rc1. The tool is still under development and is not yet publicly\navailable. Manual inspection confirms that the bug is still\npresent in v7.1.1.\n\nAn x86_64 allyesconfig build showed no new warnings. As we do not have an\nEHCI host controller with a USB isochronous device to test with, no\nruntime testing was able to be performed."}], "id": "CVE-2026-64348", "lastModified": "2026-09-03T16:03:56.440", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2026-07-25T10:17:17.040", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/4bb88aee6b868cbf73bf453f62497802f5fe4769"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/6bc17a78a05671d303820224fb37ca339c1dc2cb"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/8890699eea19027ef6e4f9cbcf27cba5e789793f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/b0d00d077f9738d215af9b50c74dffab7a1de19f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/b9399d25fbb34a05bbe76eeedd730f62ff2670e9"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/be5004395dfd0b6ec310db359f887fa396fd0dd2"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-416"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: usb: free iso schedules on failed submit", "id": "2507187", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2507187"}, "csaw": false, "cwe": "CWE-772", "details": ["A flaw was found in the Linux kernel's Universal Serial Bus (USB) subsystem. When an isochronous USB request block (URB) submission fails, the associated schedule is not properly freed. This memory leak can accumulate over time, potentially leading to memory exhaustion and a denial of service (DoS) for the system."], "name": "CVE-2026-64348", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-07-25T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-64348\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-64348\nhttps://lore.kernel.org/linux-cve-announce/2026072517-CVE-2026-64348-48f1@gregkh/T"]}