In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: fix dwc3_readl() and dwc3_writel() calls in dwc3_ulpi_setup() The… (CVE-2026-64349)
A vulnerability in the Linux kernel's USB driver (dwc3) was identified and resolved. The issue involved incorrect usage of register read and write calls in the dwc3_ulpi_setup() function, where the calls used an incorrect argument type leading to warnings and potentially a bug. This was fixed by correcting the calls to use the proper dwc3 structure pointer.
AI Analysis
Technical Summary
The Linux kernel's dwc3 USB driver contained a flaw in the dwc3_ulpi_setup() function where dwc3_readl() and dwc3_writel() calls were incorrectly invoked with dwc3->regs (a void __iomem pointer) instead of the expected dwc3 structure pointer. This mismatch caused sparse warnings about incorrect argument types and could lead to functional bugs in the USB controller setup code. The vulnerability was resolved by changing these calls to pass the correct dwc3 structure pointer, eliminating the type mismatch and potential instability.
Potential Impact
The impact is related to potential functional bugs in the USB controller initialization due to incorrect register access calls. While no direct exploit or widespread attack is known, the flaw could cause instability or incorrect behavior in USB operations on affected Linux kernel versions.
Mitigation Recommendations
No official patch links or vendor advisories are provided in the input data. Patch status is not yet confirmed — check the Linux kernel vendor advisory or trusted sources for current remediation guidance. Users should monitor for kernel updates that address this issue and apply them once available.
In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: fix dwc3_readl() and dwc3_writel() calls in dwc3_ulpi_setup() The… (CVE-2026-64349)
Description
A vulnerability in the Linux kernel's USB driver (dwc3) was identified and resolved. The issue involved incorrect usage of register read and write calls in the dwc3_ulpi_setup() function, where the calls used an incorrect argument type leading to warnings and potentially a bug. This was fixed by correcting the calls to use the proper dwc3 structure pointer.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Linux kernel's dwc3 USB driver contained a flaw in the dwc3_ulpi_setup() function where dwc3_readl() and dwc3_writel() calls were incorrectly invoked with dwc3->regs (a void __iomem pointer) instead of the expected dwc3 structure pointer. This mismatch caused sparse warnings about incorrect argument types and could lead to functional bugs in the USB controller setup code. The vulnerability was resolved by changing these calls to pass the correct dwc3 structure pointer, eliminating the type mismatch and potential instability.
Potential Impact
The impact is related to potential functional bugs in the USB controller initialization due to incorrect register access calls. While no direct exploit or widespread attack is known, the flaw could cause instability or incorrect behavior in USB operations on affected Linux kernel versions.
Mitigation Recommendations
No official patch links or vendor advisories are provided in the input data. Patch status is not yet confirmed — check the Linux kernel vendor advisory or trusted sources for current remediation guidance. Users should monitor for kernel updates that address this issue and apply them once available.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-5378-7cc2-8x2v
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-64349"]
- Ecosystems
- []
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a65420c9c2644c7f808566f
Added to database: 07/25/2026, 23:09:00 UTC
Last enriched: 07/25/2026, 23:33:42 UTC
Last updated: 07/26/2026, 03:43:08 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.