CVE-2026-64337 Details
Description
In the Linux kernel, the following vulnerability has been resolved: usb: mtu3: unmap request DMA on queue failure mtu3_gadget_queue() maps the request before checking whether the QMU GPD ring can accept another transfer. the request is returned with -EAGAIN before it is linked on the endpoint request list if mtu3_prepare_transfer() fails. Normal completion and dequeue paths unmap requests from mtu3_req_complete(), but this error path never reaches that helper, so the DMA mapping is left active. Unmap the request before returning from the failed queue path.
A vulnerability in the Linux kernel's USB MTU3 gadget driver allows for improper handling of DMA request unmapping. The issue arises because the driver maps requests before verifying if the QMU GPD ring can accommodate another transfer. If the transfer preparation fails, the request is returned with a temporary error, but the DMA mapping remains active since this error path does not trigger the normal unmapping process. As a result, the vulnerability could lead to a situation where DMA mappings are left unresolved, potentially causing memory management issues or allowing for unintended data manipulation.
Users can apply the latest patches available in the Linux kernel stable tree to address this vulnerability. The patch unmaps the request before returning from the failed queue path, ensuring that DMA mappings are properly managed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/00c3fef4c2dc2c7cbd8281f8fda09d1913420f09 | kernel.org | Patch |
| https://git.kernel.org/stable/c/0bddda5a11665c210339de76d27ebbd1a2e0b43c | kernel.org | Patch |
| https://git.kernel.org/stable/c/3cee30f1138281a1d247bb053a1ad4f7c5b04e98 | kernel.org | Patch |
| https://git.kernel.org/stable/c/4183874b7925f4a98b400cf857bea26ee87da236 | kernel.org | Patch |
| https://git.kernel.org/stable/c/835b0596d4c9bdef93f842d8f826978fb4956b74 | kernel.org | Patch |
| https://git.kernel.org/stable/c/8c29d9cfab1c3cf0d0b7fcdf9255597be30aa3e1 | kernel.org | Patch |
| https://git.kernel.org/stable/c/e8f739a3860d043dcc135371637e82f53132efe5 | kernel.org | Patch |
| https://git.kernel.org/stable/c/f3c4026524d3660c73ef2838b99776d37631e039 | kernel.org | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| NVD-CWE-noinfo | Insufficient Information to Classify Weakness | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 4.10, < 5.10.261 >= 5.11, < 5.15.212 >= 5.16, < 6.1.178 >= 6.2, < 6.6.145 >= 6.7, < 6.12.96 >= 6.13, < 6.18.39 >= 6.19, < 7.1.4 7.2 rc1 7.2 rc2 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 3, 2026 | Initial Analysis | [email protected] |
| Aug 17, 2026 | CVE Modified | kernel.org |
| Jul 25, 2026 | New CVE Received | kernel.org |