{"id":"CVE-2026-64348","title":"usb: free iso schedules on failed submit","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: free iso schedules on failed submit\n\nEHCI and FOTG210 isochronous submits build an ehci_iso_sched before\nlinking the URB to the endpoint queue, and keep the staged…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 8de98402652c01839ae321be6cb3054cf5735d83 < b0d00d077f9738d215af9b50c74dffab7a1de19f","Linux >= 8de98402652c01839ae321be6cb3054cf5735d83 < ab12316c4639237cc9d50c80a0c6240f11fbba3f","Linux >= 8de98402652c01839ae321be6cb3054cf5735d83 < be5004395dfd0b6ec310db359f887fa396fd0dd2","Linux >= 8de98402652c01839ae321be6cb3054cf5735d83 < 8890699eea19027ef6e4f9cbcf27cba5e789793f","Linux >= 8de98402652c01839ae321be6cb3054cf5735d83 < 6bc17a78a05671d303820224fb37ca339c1dc2cb","Linux >= 8de98402652c01839ae321be6cb3054cf5735d83 < 4bb88aee6b868cbf73bf453f62497802f5fe4769","Linux >= 8de98402652c01839ae321be6cb3054cf5735d83 < b9399d25fbb34a05bbe76eeedd730f62ff2670e9","Linux 2.6.15"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-06T16:36:27.229286Z"},"published":"2026-07-25","updated":"2026-11-06","sourceUpdated":"2026-11-06T16:44:48.289Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-64348","references":[{"url":"https://git.kernel.org/stable/c/b0d00d077f9738d215af9b50c74dffab7a1de19f"},{"url":"https://git.kernel.org/stable/c/ab12316c4639237cc9d50c80a0c6240f11fbba3f"},{"url":"https://git.kernel.org/stable/c/be5004395dfd0b6ec310db359f887fa396fd0dd2"},{"url":"https://git.kernel.org/stable/c/8890699eea19027ef6e4f9cbcf27cba5e789793f"},{"url":"https://git.kernel.org/stable/c/6bc17a78a05671d303820224fb37ca339c1dc2cb"},{"url":"https://git.kernel.org/stable/c/4bb88aee6b868cbf73bf453f62497802f5fe4769"},{"url":"https://git.kernel.org/stable/c/b9399d25fbb34a05bbe76eeedd730f62ff2670e9"}],"tags":["cve.org"],"epss":0.00129,"epssPercentile":0.02585,"ingestedAt":"2026-11-05T15:02:32.419Z","slug":"CVE-2026-64348","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nusb: free iso schedules on failed submit\n\nEHCI and FOTG210 isochronous submits build an ehci_iso_sched before\nlinking the URB to the endpoint queue, and keep the staged schedule in\nurb->hcpriv until iso_stream_schedule() and the link helpers consume it.\nIf the controller is no longer accessible, or usb_hcd_link_urb_to_ep()\nfails, submit jumps to done_not_linked before that handoff happens and\nleaks the staged schedule still attached to urb->hcpriv.\n\nFree the staged schedule from done_not_linked when submit fails before\nthe URB is linked and clear urb->hcpriv after the free.\n\nThe bug was first flagged by an experimental analysis tool we are\ndeveloping for kernel memory-management bugs while analyzing\nv6.13-rc1. The tool is still under development and is not yet publicly\navailable. Manual inspection confirms that the bug is still\npresent in v7.1.1.\n\nAn x86_64 allyesconfig build showed no new warnings. As we do not have an\nEHCI host controller with a USB isochronous device to test with, no\nruntime testing was able to be performed.\n\n## Affected\n\n- `Linux >= 8de98402652c01839ae321be6cb3054cf5735d83 < b0d00d077f9738d215af9b50c74dffab7a1de19f`\n- `Linux >= 8de98402652c01839ae321be6cb3054cf5735d83 < ab12316c4639237cc9d50c80a0c6240f11fbba3f`\n- `Linux >= 8de98402652c01839ae321be6cb3054cf5735d83 < be5004395dfd0b6ec310db359f887fa396fd0dd2`\n- `Linux >= 8de98402652c01839ae321be6cb3054cf5735d83 < 8890699eea19027ef6e4f9cbcf27cba5e789793f`\n- `Linux >= 8de98402652c01839ae321be6cb3054cf5735d83 < 6bc17a78a05671d303820224fb37ca339c1dc2cb`\n- `Linux >= 8de98402652c01839ae321be6cb3054cf5735d83 < 4bb88aee6b868cbf73bf453f62497802f5fe4769`\n- `Linux >= 8de98402652c01839ae321be6cb3054cf5735d83 < b9399d25fbb34a05bbe76eeedd730f62ff2670e9`\n- `Linux 2.6.15`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}