Memory leak in Linux kernel - CVE-2026-64348
Published: July 27, 2026
Vulnerability identifier: #VU139614
CSH Severity: Low
CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-64348
CWE-ID: CWE-401
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a memory leak in the EHCI and FOTG210 isochronous submit handling when submitting a URB before it is linked to the endpoint queue. A local user can trigger a failed submit to cause a denial of service.
Exploitation requires access to a system using EHCI or FOTG210 USB isochronous transfers.
Affected software
Linux kernel
How to mitigate CVE-2026-64348
Install security update from vendor's repository.
Linux kernel - update to 7.0 rc3
External References
- https://git.kernel.org/stable/c/4bb88aee6b868cbf73bf453f62497802f5fe4769
- https://git.kernel.org/stable/c/6bc17a78a05671d303820224fb37ca339c1dc2cb
- https://git.kernel.org/stable/c/8890699eea19027ef6e4f9cbcf27cba5e789793f
- https://git.kernel.org/stable/c/b0d00d077f9738d215af9b50c74dffab7a1de19f
- https://git.kernel.org/stable/c/b9399d25fbb34a05bbe76eeedd730f62ff2670e9
- https://git.kernel.org/stable/c/be5004395dfd0b6ec310db359f887fa396fd0dd2