In the Linux kernel, the following vulnerability has been resolved: usbip: vudc: fix NULL deref in vep_dequeue() vep_alloc_request() wasn't… (CVE-2026-64331)
In the Linux kernel, the following vulnerability has been resolved: usbip: vudc: fix NULL deref in vep_dequeue() vep_alloc_request() wasn't initializing vrequest->udc, so cancellations on the FunctionFS AIO path were arriving in vep_dequeue without a valid UDC reference. Since vrequest->udc is never actually properly used anywhere, we opt to remove it, and update vep_dequeue to obtain a reference to the udc with ep_to_vudc(), consistent with the other vep_ ops. AFAICT this bug has existed for ~10 years. Seems that nobody has really stressed the FunctionFS AIO path on usbip's vudc. I tested this fix in a QEMU aarch64 guest driving FunctionFS endpoints via AIO. Before the fix, running `usbip attach` from the host would cause the guest to oops with the following backtrace: Call trace: vep_dequeue+0x1c/0xe4 (P) usb_ep_dequeue+0x14/0x20 ffs_aio_cancel+0x24/0x34 __arm64_sys_io_cancel+0xb0/0x124 do_el0_svc+0x68/0x100 el0_svc+0x18/0x5c el0t_64_sync_handler+0x98/0xdc el0t_64_sync+0x154/0x158
AI Analysis
Technical Summary
The Linux kernel usbip subsystem contained a long-standing NULL pointer dereference vulnerability in the vep_dequeue() function. This was due to vep_alloc_request() failing to initialize the vrequest->udc pointer, which led to cancellations arriving without a valid UDC reference on the FunctionFS AIO path. The patch removes the unused vrequest->udc field and modifies vep_dequeue() to obtain the UDC reference correctly via ep_to_vudc(), aligning with other vep operations. Testing showed that before the fix, attaching usbip devices could cause kernel oopses with a specific backtrace. This vulnerability has been resolved in the Linux kernel.
Potential Impact
The vulnerability could cause kernel crashes (NULL pointer dereference) when using usbip with FunctionFS AIO endpoints, potentially leading to denial of service on affected systems. There is no indication of privilege escalation or code execution. No known exploits in the wild have been reported.
Mitigation Recommendations
A fix for this vulnerability has been implemented in the Linux kernel. Users should update to a kernel version that includes this patch to prevent kernel crashes related to usbip FunctionFS AIO operations. Since this is a kernel-level fix, applying the official kernel update is the recommended remediation.
In the Linux kernel, the following vulnerability has been resolved: usbip: vudc: fix NULL deref in vep_dequeue() vep_alloc_request() wasn't… (CVE-2026-64331)
Description
In the Linux kernel, the following vulnerability has been resolved: usbip: vudc: fix NULL deref in vep_dequeue() vep_alloc_request() wasn't initializing vrequest->udc, so cancellations on the FunctionFS AIO path were arriving in vep_dequeue without a valid UDC reference. Since vrequest->udc is never actually properly used anywhere, we opt to remove it, and update vep_dequeue to obtain a reference to the udc with ep_to_vudc(), consistent with the other vep_ ops. AFAICT this bug has existed for ~10 years. Seems that nobody has really stressed the FunctionFS AIO path on usbip's vudc. I tested this fix in a QEMU aarch64 guest driving FunctionFS endpoints via AIO. Before the fix, running `usbip attach` from the host would cause the guest to oops with the following backtrace: Call trace: vep_dequeue+0x1c/0xe4 (P) usb_ep_dequeue+0x14/0x20 ffs_aio_cancel+0x24/0x34 __arm64_sys_io_cancel+0xb0/0x124 do_el0_svc+0x68/0x100 el0_svc+0x18/0x5c el0t_64_sync_handler+0x98/0xdc el0t_64_sync+0x154/0x158
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Linux kernel usbip subsystem contained a long-standing NULL pointer dereference vulnerability in the vep_dequeue() function. This was due to vep_alloc_request() failing to initialize the vrequest->udc pointer, which led to cancellations arriving without a valid UDC reference on the FunctionFS AIO path. The patch removes the unused vrequest->udc field and modifies vep_dequeue() to obtain the UDC reference correctly via ep_to_vudc(), aligning with other vep operations. Testing showed that before the fix, attaching usbip devices could cause kernel oopses with a specific backtrace. This vulnerability has been resolved in the Linux kernel.
Potential Impact
The vulnerability could cause kernel crashes (NULL pointer dereference) when using usbip with FunctionFS AIO endpoints, potentially leading to denial of service on affected systems. There is no indication of privilege escalation or code execution. No known exploits in the wild have been reported.
Mitigation Recommendations
A fix for this vulnerability has been implemented in the Linux kernel. Users should update to a kernel version that includes this patch to prevent kernel crashes related to usbip FunctionFS AIO operations. Since this is a kernel-level fix, applying the official kernel update is the recommended remediation.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-x846-472j-jj99
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-64331"]
- Ecosystems
- []
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a65420d9c2644c7f8085683
Added to database: 07/25/2026, 23:09:01 UTC
Last enriched: 07/25/2026, 23:33:59 UTC
Last updated: 09/08/2026, 22:52:14 UTC
Views: 34
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.