CVE-2026-64464: Linux kernel · xhci: sideband: fix ring sg table pages leak
Affects Linux kernelSource GCVE Database
Not known to be exploited · fixed in 7.0.0-1012.12~24.04.1 : update Linux kernel when convenient.
Data as of 26 Oct 2026, 13:47 UTC
Rated by Threat Radar · No CVSS score from NVD or the CNA
- EPSS
- 0.2% chance of exploitation in 30 days – higher than 10% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Patch
- Available – fixed in 7.0.0-1012.12~24.04.1, 7.0.0-1011.11~24.04.1, 7.0.0-31.31~24.04.1 +7
Exploitation evidence
Disclosed: evidence found.
CVE published 25 Jul 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Upgrade to a fixed release listed under Affected software.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
Ubuntu 26.04 LTSlinuxpkg:deb/ubuntu/linux?arch=source&distro=resoluteOther threats | Affected
| Fixed in
|
Ubuntu 26.04 LTSlinux-awspkg:deb/ubuntu/linux-aws?arch=source&distro=resoluteOther threats | Affected
| Fixed in
|
Ubuntu 26.04 LTSlinux-azurepkg:deb/ubuntu/linux-azure?arch=source&distro=resoluteOther threats | Affected
| Fixed in– |
Ubuntu 26.04 LTSlinux-azure-fdepkg:deb/ubuntu/linux-azure-fde?arch=source&distro=resoluteOther threats | Affected
| Fixed in– |
Ubuntu 26.04 LTSlinux-gcppkg:deb/ubuntu/linux-gcp?arch=source&distro=resoluteOther threats | Affected
| Fixed in
|
Ubuntu 26.04 LTSlinux-gkepkg:deb/ubuntu/linux-gke?arch=source&distro=resoluteOther threats | Affected
| Fixed in
|
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
A patch is available from the vendor. Users should update their Linux kernel packages to the fixed versions listed in the Ubuntu security notices (e.g., linux-image-7.0.0-31.31 and later). After updating, a system reboot is required to apply the changes. Due to an ABI change in the kernel, all third-party kernel modules must be recompiled and reinstalled to ensure compatibility. Follow the vendor's update instructions and verify kernel module rebuilds to fully remediate the issue.
Description
In the Linux kernel, the following vulnerability has been resolved: xhci: sideband: fix ring sg table pages leak xhci_ring_to_sgtable() allocates a temporary pages array and uses it to build the returned sg_table with sg_alloc_table_from_pages(). The error paths free the pages array, but the success path returns the sg_table without freeing it. This leaks the temporary array every time a sideband client gets an endpoint or event ring buffer. Free the pages array after sg_alloc_table_from_pages() succeeds. The returned sg_table has its own scatterlist entries and does not depend on the temporary array after construction.
References
- nvd.nist.gov/vuln/detail/CVE-2026-64464 (opens in a new tab)
- git.kernel.org/stable/c/49f6e3c3ef19f04f6657ed8dce550e36c763abb8 (opens in a new tab)
- git.kernel.org/stable/c/99d00a9e35e311a91d258029d5bb584377296c34 (opens in a new tab)
- git.kernel.org/stable/c/a3eaf82ff842d6ca95937ea584417e04828235a6 (opens in a new tab)
- ubuntu.com/security/CVE-2026-64464 (opens in a new tab)
- cve.org/CVERecord?id=CVE-2026-64464 (opens in a new tab)
- git.kernel.org/linus/49f6e3c3ef19f04f6657ed8dce550e36c763abb8 (opens in a new tab)
- ubuntu.com/security/notices/USN-8726-1 (opens in a new tab)
- ubuntu.com/security/notices/USN-8727-1 (opens in a new tab)
- ubuntu.com/security/notices/USN-8728-1 (opens in a new tab)