The Linux kernel vulnerability CVE-2026-64464 involves a resource leak in the xhci_ring_to_sgtable() function within the xhci sideband code. This function allocates a temporary pages array to build an sg_table but fails to free this array on the success path, leaking memory each time a sideband client obtains an endpoint or event ring buffer. The fix ensures the temporary pages array is freed after successful sg_table construction, preventing the leak. This issue affects multiple kernel versions prior to 7.0.0-31.31~24.04.1 and related releases for Ubuntu 24.04 LTS. The vendor advisory confirms a patch is available and recommends updating to fixed kernel versions. The update requires a system reboot and recompilation of third-party kernel modules due to an ABI change.

The vulnerability causes a memory leak in the kernel's USB xHCI sideband code, which could lead to resource exhaustion over time on affected systems. While the leak itself does not directly enable code execution or privilege escalation, it may degrade system stability or performance if exploited repeatedly. The vendor advisory notes multiple kernel security fixes in the same update, but this specific issue is a resource leak rather than a direct security bypass or escalation.

A patch is available from the vendor. Users should update their Linux kernel packages to the fixed versions listed in the Ubuntu security notices (e.g., linux-image-7.0.0-31.31 and later). After updating, a system reboot is required to apply the changes. Due to an ABI change in the kernel, all third-party kernel modules must be recompiled and reinstalled to ensure compatibility. Follow the vendor's update instructions and verify kernel module rebuilds to fully remediate the issue.