In the Linux kernel, the following vulnerability has been resolved: usb: mtu3: unmap request DMA on queue failure mtu3_gadget_queue() maps the… (CVE-2026-64337)
Source GCVE Database
No CVSS score published yet
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.1% chance of exploitation in 30 days – higher than 4% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
What to do
AI-suggested
A fix has been implemented in the Linux kernel to unmap DMA requests on queue failure in the mtu3 driver. Users should apply the official kernel updates that include this fix. Patch status is not explicitly confirmed in the provided data; therefore, check the vendor or Linux kernel advisory for the current remediation guidance.
Description
In the Linux kernel, the following vulnerability has been resolved: usb: mtu3: unmap request DMA on queue failure mtu3_gadget_queue() maps the request before checking whether the QMU GPD ring can accept another transfer. the request is returned with -EAGAIN before it is linked on the endpoint request list if mtu3_prepare_transfer() fails. Normal completion and dequeue paths unmap requests from mtu3_req_complete(), but this error path never reaches that helper, so the DMA mapping is left active. Unmap the request before returning from the failed queue path.
Impact
The vulnerability results in DMA mappings remaining active after a queue failure, potentially causing resource leakage or instability in the USB gadget driver subsystem. There is no indication of direct code execution or privilege escalation from the provided data. No known exploits are reported in the wild.
Summary
The Linux kernel's usb: mtu3 driver had a vulnerability where the function mtu3_gadget_queue() mapped DMA requests before verifying if the QMU GPD ring could accept another transfer. If mtu3_prepare_transfer() failed, the request was returned with an error (-EAGAIN) without being linked to the endpoint request list, and crucially, the DMA mapping was not unmapped due to the error path not invoking the unmapping helper mtu3_req_complete(). This left DMA mappings active unintentionally, which was corrected by adding unmapping of the request before returning from the failure path.
References
- nvd.nist.gov/vuln/detail/CVE-2026-64337 (opens in a new tab)
- git.kernel.org/stable/c/00c3fef4c2dc2c7cbd8281f8fda09d1913420f09 (opens in a new tab)
- git.kernel.org/stable/c/0bddda5a11665c210339de76d27ebbd1a2e0b43c (opens in a new tab)
- git.kernel.org/stable/c/3cee30f1138281a1d247bb053a1ad4f7c5b04e98 (opens in a new tab)
- git.kernel.org/stable/c/4183874b7925f4a98b400cf857bea26ee87da236 (opens in a new tab)
- git.kernel.org/stable/c/835b0596d4c9bdef93f842d8f826978fb4956b74 (opens in a new tab)
- git.kernel.org/stable/c/8c29d9cfab1c3cf0d0b7fcdf9255597be30aa3e1 (opens in a new tab)
- git.kernel.org/stable/c/e8f739a3860d043dcc135371637e82f53132efe5 (opens in a new tab)
- git.kernel.org/stable/c/f3c4026524d3660c73ef2838b99776d37631e039 (opens in a new tab)