Strix
26.1K

CVE-2026-64337

UnknownEPSS 0.21%

Last modified

CVE-2026-64337 is a vulnerability of currently unknown severity. In the Linux kernel, the following vulnerability has been resolved: usb: mtu3: unmap request DMA on queue failure mtu3_gadget_queue() maps the request before checking whether the QMU GPD ring can accept another transfer. the request is returned with -EAGAIN before it is linked on the endpoint request list if mtu3_prepare_transfer() fails. Normal completion and dequeue paths unmap requests from mtu3_req_complete(), but this error path never reaches that helper, so the DMA mapping is left active. EPSS estimates a 0.21% chance of exploitation in the next 30 days.

Description

In the Linux kernel, the following vulnerability has been resolved: usb: mtu3: unmap request DMA on queue failure mtu3_gadget_queue() maps the request before checking whether the QMU GPD ring can accept another transfer. the request is returned with -EAGAIN before it is linked on the endpoint request list if mtu3_prepare_transfer() fails. Normal completion and dequeue paths unmap requests from mtu3_req_complete(), but this error path never reaches that helper, so the DMA mapping is left active. Unmap the request before returning from the failed queue path.

Metrics

EPSS Probability
0.21%

11.4th percentile

Probability of exploitation in the next 30 days. Learn more

Affected Software

Source: CNA advisory (CVE.org). NVD analysis pending.

VendorProductVersions
LinuxLinux>= df2069acb00569a6299d6e11aa1865eeba463848, < 3cee30f1138281a1d247bb053a1ad4f7c5b04e98; >= df2069acb00569a6299d6e11aa1865eeba463848, < f3c4026524d3660c73ef2838b99776d37631e039; >= df2069acb00569a6299d6e11aa1865eeba463848, < e8f739a3860d043dcc135371637e82f53132efe5; >= df2069acb00569a6299d6e11aa1865eeba463848, < 4183874b7925f4a98b400cf857bea26ee87da236; >= df2069acb00569a6299d6e11aa1865eeba463848, < 00c3fef4c2dc2c7cbd8281f8fda09d1913420f09; >= df2069acb00569a6299d6e11aa1865eeba463848, < 8c29d9cfab1c3cf0d0b7fcdf9255597be30aa3e1; >= df2069acb00569a6299d6e11aa1865eeba463848, < 835b0596d4c9bdef93f842d8f826978fb4956b74; >= df2069acb00569a6299d6e11aa1865eeba463848, < 0bddda5a11665c210339de76d27ebbd1a2e0b43c
LinuxLinux4.10

References

Timeline

Published
Last Modified
Status
Awaiting Analysis

Frequently Asked Questions

What is CVE-2026-64337?
In the Linux kernel, the following vulnerability has been resolved: usb: mtu3: unmap request DMA on queue failure mtu3_gadget_queue() maps the request before checking whether the QMU GPD ring can accept another transfer. the request is returned with -EAGAIN before it is linked on the endpoint request list if mtu3_prepare_transfer() fails. Normal completion and dequeue paths unmap requests from mtu3_req_complete(), but this error path never reaches that helper, so the DMA mapping is left active. Unmap the request before returning from the failed queue path.
How severe is CVE-2026-64337?
Severity scoring for CVE-2026-64337 is pending analysis. The EPSS model estimates a 0.21% probability of exploitation in the next 30 days.
How do I fix CVE-2026-64337?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2026

View all 2026CVEs →

Are you affected by CVE-2026-64337?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST