CVE-2026-64348: usb: free iso schedules on failed submit

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-07-25 · updated 2026-10-30
Weakness: CWE-416

Description

In the Linux kernel, the following vulnerability has been resolved: usb: free iso schedules on failed submit EHCI and FOTG210 isochronous submits build an ehci_iso_sched before linking the URB to the endpoint queue, and keep the staged schedule in urb->hcpriv until iso_stream_schedule() and the link helpers consume it. If the controller is no longer accessible, or usb_hcd_link_urb_to_ep() fails, submit jumps to done_not_linked before that handoff happens and leaks the staged schedule still attached to urb->hcpriv. Free the staged schedule from done_not_linked when submit fails before the URB is linked and clear urb->hcpriv after the free. The bug was first flagged by an experimental analysis tool we are developing for kernel memory-management bugs while analyzing v6.13-rc1. The tool is still under development and is not yet publicly available. Manual inspection confirms that the bug is still present in v7.1.1. An x86_64 allyesconfig build showed no new warnings. As we do not have an EHCI host controller with a USB isochronous device to test with, no runtime testing was able to be performed.

Affected products

Linux kernel: from 2.6.15.1 before 5.10.261; from 5.11 before 6.6.145; from 6.7 before 6.12.96; from 6.13 before 6.18.39; from 6.19 before 7.1.4; 2.6.15-rc4, 2.6.15-rc5, 2.6.15-rc6, 2.6.15-rc7, 7.2-rc1, 7.2-rc2 — fixed in 5.10.261, 6.6.145, 6.12.96, 6.18.39, 7.1.4
Linux: 2.6.15 — fixed in 7.2

How to fix

Upgrade to a fixed version: Linux kernel 5.10.261, 6.6.145, 6.12.96, 6.18.39; Linux 7.2. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-64348 or the next vulnerability affects your stack