The Linux kernel vulnerability CVE-2026-64350 involves a memory leak in the usb: cdnsp driver, specifically in the cdnsp_alloc_stream_info() function. When allocation of stream rings or stream mapping updates fail, the error handling path frees some allocated resources but omits freeing the stream_ctx_array, causing a leak. This flaw has been resolved in Linux kernel updates. The vulnerability has a CVSS 3.1 score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), indicating local attack vector with low complexity and privileges required, no user interaction, unchanged scope, no confidentiality or integrity impact, but high impact on availability. Ubuntu has released security notices USN-8726-1 and USN-8727-1 detailing fixes in various Linux kernel packages including linux-hwe-7.0 and linux-oem-7.0. Users must update to fixed kernel versions and reboot. Due to ABI changes, recompilation of third-party kernel modules is necessary.

The vulnerability causes a memory leak in the Linux kernel's usb: cdnsp subsystem, which can lead to denial of service by exhausting kernel memory resources. There is no impact on confidentiality or integrity. The attack requires local access with low privileges and no user interaction. The availability of the affected system can be degraded or disrupted due to the leak. No known exploits in the wild have been reported.

An official patch is available and should be applied by updating the Linux kernel to the fixed versions provided by the vendor (Ubuntu). After updating, a system reboot is required to apply the changes. Due to an ABI change in the kernel update, all third-party kernel modules must be recompiled and reinstalled. Users should follow the vendor's update instructions carefully. No additional mitigation is required beyond applying the official fixes.