OCTOBER 21, 2026
Live Feed
Back to database
Case File

CVE-2026-64337

UNKNOWN · CVSS N/A EPSS 0.21%

Source: NVD + CISA KEV + EPSS · Published 2026-07-25 · Last synced 2026-08-24

CyberRota Analysis

AI-Generated

The vulnerability affects the Linux kernel's USB driver, specifically the mtu3 gadget, where a failure in the queueing process can lead to a failure to unmap DMA requests. This oversight can result in memory leaks or potential denial-of-service conditions due to unhandled DMA mappings. Organizations using Linux systems with the affected USB functionality should prioritize patching to mitigate these risks.

CVE
CVE-2026-64337
Severity
UNKNOWN
CVSS
N/A
EPSS
0.21%
Linux

Original NVD Description

In the Linux kernel, the following vulnerability has been resolved: usb: mtu3: unmap request DMA on queue failure mtu3_gadget_queue() maps the request before checking whether the QMU GPD ring can accept another transfer. the request is returned with -EAGAIN before it is linked on the endpoint request list if mtu3_prepare_transfer() fails. Normal completion and dequeue paths unmap requests from mtu3_req_complete(), but this error path never reaches that helper, so the DMA mapping is left active. Unmap the request before returning from the failed queue path.