1. Home
  2. Vulnerabilities
  3. CVE-2026-64337
0.0
NA
CVE-2026-64337
usb: mtu3: unmap request DMA on queue failure
Overview
Description

In the Linux kernel, the following vulnerability has been resolved: usb: mtu3: unmap request DMA on queue failure mtu3_gadget_queue() maps the request before checking whether the QMU GPD ring can accept another transfer. the request is returned with -EAGAIN before it is linked on the endpoint request list if mtu3_prepare_transfer() fails. Normal completion and dequeue paths unmap requests from mtu3_req_complete(), but this error path never reaches that helper, so the DMA mapping is left active. Unmap the request before returning from the failed queue path.

Details
INFO

Published Date :

July 25, 2026, 10:17 a.m.

Last Modified :

Aug. 17, 2026, 5:17 a.m.

Remotely Exploit :

No

Source :

416baaa9-dc9f-4396-8d5f-8c081fb06d67
Impact
Affected Products

The following products are affected by CVE-2026-64337 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID Vendor Product Action
1 Linux linux_kernel
: Total Affected Vendor : 1 | Products : 1
Solution
Unmap DMA mapping on queue failure to prevent resource leaks.
  • Unmap the request before returning from the failed queue path.
  • Ensure DMA mappings are properly managed in error scenarios.
  • Update the Linux kernel to the latest patched version.
References
References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2026-64337.

URL Resource
https://git.kernel.org/stable/c/00c3fef4c2dc2c7cbd8281f8fda09d1913420f09
https://git.kernel.org/stable/c/0bddda5a11665c210339de76d27ebbd1a2e0b43c
https://git.kernel.org/stable/c/3cee30f1138281a1d247bb053a1ad4f7c5b04e98
https://git.kernel.org/stable/c/4183874b7925f4a98b400cf857bea26ee87da236
https://git.kernel.org/stable/c/835b0596d4c9bdef93f842d8f826978fb4956b74
https://git.kernel.org/stable/c/8c29d9cfab1c3cf0d0b7fcdf9255597be30aa3e1
https://git.kernel.org/stable/c/e8f739a3860d043dcc135371637e82f53132efe5
https://git.kernel.org/stable/c/f3c4026524d3660c73ef2838b99776d37631e039
CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2026-64337 is associated with the following CWEs:

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2026-64337 weaknesses.

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2026-64337 vulnerability anywhere in the article.

Results are limited to the first 20 news articles due to potential performance issues.

The following table lists the changes that have been made to the CVE-2026-64337 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.

  • CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67

    Aug. 17, 2026

    Action Type Old Value New Value
    Changed Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': 'df2069acb00569a6299d6e11aa1865eeba463848', 'lessThan': '3cee30f1138281a1d247bb053a1ad4f7c5b04e98', 'versionType': 'git'}, {'status': 'affected', 'version': 'df2069acb00569a6299d6e11aa1865eeba463848', 'lessThan': 'f3c4026524d3660c73ef2838b99776d37631e039', 'versionType': 'git'}, {'status': 'affected', 'version': 'df2069acb00569a6299d6e11aa1865eeba463848', 'lessThan': 'e8f739a3860d043dcc135371637e82f53132efe5', 'versionType': 'git'}, {'status': 'affected', 'version': 'df2069acb00569a6299d6e11aa1865eeba463848', 'lessThan': '4183874b7925f4a98b400cf857bea26ee87da236', 'versionType': 'git'}, {'status': 'affected', 'version': 'df2069acb00569a6299d6e11aa1865eeba463848', 'lessThan': '00c3fef4c2dc2c7cbd8281f8fda09d1913420f09', 'versionType': 'git'}, {'status': 'affected', 'version': 'df2069acb00569a6299d6e11aa1865eeba463848', 'lessThan': '8c29d9cfab1c3cf0d0b7fcdf9255597be30aa3e1', 'versionType': 'git'}, {'status': 'affected', 'version': 'df2069acb00569a6299d6e11aa1865eeba463848', 'lessThan': '835b0596d4c9bdef93f842d8f826978fb4956b74', 'versionType': 'git'}, {'status': 'affected', 'version': 'df2069acb00569a6299d6e11aa1865eeba463848', 'lessThan': '0bddda5a11665c210339de76d27ebbd1a2e0b43c', 'versionType': 'git'}], 'programFiles': ['drivers/usb/mtu3/mtu3_gadget.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '4.10'}, {'status': 'unaffected', 'version': '0', 'lessThan': '4.10', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '5.10.261', 'versionType': 'semver', 'lessThanOrEqual': '5.10.*'}, {'status': 'unaffected', 'version': '5.15.212', 'versionType': 'semver', 'lessThanOrEqual': '5.15.*'}, {'status': 'unaffected', 'version': '6.1.178', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.145', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.96', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.39', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.4', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2-rc3', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['drivers/usb/mtu3/mtu3_gadget.c'], 'defaultStatus': 'affected'}] [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': 'df2069acb00569a6299d6e11aa1865eeba463848', 'lessThan': '3cee30f1138281a1d247bb053a1ad4f7c5b04e98', 'versionType': 'git'}, {'status': 'affected', 'version': 'df2069acb00569a6299d6e11aa1865eeba463848', 'lessThan': 'f3c4026524d3660c73ef2838b99776d37631e039', 'versionType': 'git'}, {'status': 'affected', 'version': 'df2069acb00569a6299d6e11aa1865eeba463848', 'lessThan': 'e8f739a3860d043dcc135371637e82f53132efe5', 'versionType': 'git'}, {'status': 'affected', 'version': 'df2069acb00569a6299d6e11aa1865eeba463848', 'lessThan': '4183874b7925f4a98b400cf857bea26ee87da236', 'versionType': 'git'}, {'status': 'affected', 'version': 'df2069acb00569a6299d6e11aa1865eeba463848', 'lessThan': '00c3fef4c2dc2c7cbd8281f8fda09d1913420f09', 'versionType': 'git'}, {'status': 'affected', 'version': 'df2069acb00569a6299d6e11aa1865eeba463848', 'lessThan': '8c29d9cfab1c3cf0d0b7fcdf9255597be30aa3e1', 'versionType': 'git'}, {'status': 'affected', 'version': 'df2069acb00569a6299d6e11aa1865eeba463848', 'lessThan': '835b0596d4c9bdef93f842d8f826978fb4956b74', 'versionType': 'git'}, {'status': 'affected', 'version': 'df2069acb00569a6299d6e11aa1865eeba463848', 'lessThan': '0bddda5a11665c210339de76d27ebbd1a2e0b43c', 'versionType': 'git'}], 'programFiles': ['drivers/usb/mtu3/mtu3_gadget.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '4.10'}, {'status': 'unaffected', 'version': '0', 'lessThan': '4.10', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '5.10.261', 'versionType': 'semver', 'lessThanOrEqual': '5.10.*'}, {'status': 'unaffected', 'version': '5.15.212', 'versionType': 'semver', 'lessThanOrEqual': '5.15.*'}, {'status': 'unaffected', 'version': '6.1.178', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.145', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.96', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.39', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.4', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['drivers/usb/mtu3/mtu3_gadget.c'], 'defaultStatus': 'affected'}]
  • New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67

    Jul. 25, 2026

    Action Type Old Value New Value
    Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': 'df2069acb00569a6299d6e11aa1865eeba463848', 'lessThan': '3cee30f1138281a1d247bb053a1ad4f7c5b04e98', 'versionType': 'git'}, {'status': 'affected', 'version': 'df2069acb00569a6299d6e11aa1865eeba463848', 'lessThan': 'f3c4026524d3660c73ef2838b99776d37631e039', 'versionType': 'git'}, {'status': 'affected', 'version': 'df2069acb00569a6299d6e11aa1865eeba463848', 'lessThan': 'e8f739a3860d043dcc135371637e82f53132efe5', 'versionType': 'git'}, {'status': 'affected', 'version': 'df2069acb00569a6299d6e11aa1865eeba463848', 'lessThan': '4183874b7925f4a98b400cf857bea26ee87da236', 'versionType': 'git'}, {'status': 'affected', 'version': 'df2069acb00569a6299d6e11aa1865eeba463848', 'lessThan': '00c3fef4c2dc2c7cbd8281f8fda09d1913420f09', 'versionType': 'git'}, {'status': 'affected', 'version': 'df2069acb00569a6299d6e11aa1865eeba463848', 'lessThan': '8c29d9cfab1c3cf0d0b7fcdf9255597be30aa3e1', 'versionType': 'git'}, {'status': 'affected', 'version': 'df2069acb00569a6299d6e11aa1865eeba463848', 'lessThan': '835b0596d4c9bdef93f842d8f826978fb4956b74', 'versionType': 'git'}, {'status': 'affected', 'version': 'df2069acb00569a6299d6e11aa1865eeba463848', 'lessThan': '0bddda5a11665c210339de76d27ebbd1a2e0b43c', 'versionType': 'git'}], 'programFiles': ['drivers/usb/mtu3/mtu3_gadget.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '4.10'}, {'status': 'unaffected', 'version': '0', 'lessThan': '4.10', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '5.10.261', 'versionType': 'semver', 'lessThanOrEqual': '5.10.*'}, {'status': 'unaffected', 'version': '5.15.212', 'versionType': 'semver', 'lessThanOrEqual': '5.15.*'}, {'status': 'unaffected', 'version': '6.1.178', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.145', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.96', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.39', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.4', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2-rc3', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['drivers/usb/mtu3/mtu3_gadget.c'], 'defaultStatus': 'affected'}]
    Added Description In the Linux kernel, the following vulnerability has been resolved: usb: mtu3: unmap request DMA on queue failure mtu3_gadget_queue() maps the request before checking whether the QMU GPD ring can accept another transfer. the request is returned with -EAGAIN before it is linked on the endpoint request list if mtu3_prepare_transfer() fails. Normal completion and dequeue paths unmap requests from mtu3_req_complete(), but this error path never reaches that helper, so the DMA mapping is left active. Unmap the request before returning from the failed queue path.
    Added Reference https://git.kernel.org/stable/c/00c3fef4c2dc2c7cbd8281f8fda09d1913420f09
    Added Reference https://git.kernel.org/stable/c/0bddda5a11665c210339de76d27ebbd1a2e0b43c
    Added Reference https://git.kernel.org/stable/c/3cee30f1138281a1d247bb053a1ad4f7c5b04e98
    Added Reference https://git.kernel.org/stable/c/4183874b7925f4a98b400cf857bea26ee87da236
    Added Reference https://git.kernel.org/stable/c/835b0596d4c9bdef93f842d8f826978fb4956b74
    Added Reference https://git.kernel.org/stable/c/8c29d9cfab1c3cf0d0b7fcdf9255597be30aa3e1
    Added Reference https://git.kernel.org/stable/c/e8f739a3860d043dcc135371637e82f53132efe5
    Added Reference https://git.kernel.org/stable/c/f3c4026524d3660c73ef2838b99776d37631e039
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.
CVSS
Vulnerability Scoring Details
No CVSS metrics available for this vulnerability.