What is the CVSS score of CVE-2026-64240?

CVE-2026-64240 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-64240?

Yes, a patch is available for CVE-2026-64240. Update the affected software to the latest version immediately.

Linux Kernel CVE-2026-64240

EUVD-2026-48649 MEDIUM

2026-07-24 Linux

GHSA-v7jf-3mfx-ch6j

Information Disclosure Linux Red Hat Suse

5.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

5.5 MEDIUM

Requires local low-privileged access and specific hardware attachment; impact is availability only with no confidentiality or integrity consequences.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 19:46 vuln.today

CVSS changed

Aug 13, 2026 - 17:37 NVD

5.5 (MEDIUM)

Patch available

Jul 24, 2026 - 17:48 EUVD

CVE Published

Jul 24, 2026 - 15:27 nvd

MEDIUM 5.5

CVE Published

Jul 24, 2026 - 15:27 cve.org

UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

media: rc: igorplugusb: fix control request setup packet

Commit eac69475b01f ("media: rc: igorplugusb: heed coherency rules") changed the control request storage from an embedded struct to an allocated pointer so it can obey DMA coherency rules.

However, the driver still passes &ir->request to usb_fill_control_urb(). That points the URB setup packet at the pointer field itself rather than at the allocated struct usb_ctrlrequest.

USB core then interprets pointer bytes as the setup packet. This can produce an invalid bRequestType and trigger the control direction warning reported by syzbot:

usb 2-1: BOGUS control dir, pipe 80003580 doesn't match bRequestType 0

Pass ir->request itself as the setup packet.

AnalysisAI

Incorrect pointer passing in the Linux kernel's igorplugusb infrared USB receiver driver causes the USB core to misinterpret raw pointer bytes as a USB control setup packet, triggering a BOGUS control direction warning and a kernel-level denial of service. The regression was introduced by commit eac69475b01f, which allocated ir->request as a pointer for DMA coherency but left the usb_fill_control_urb() call referencing &ir->request (the pointer variable's address) rather than ir->request (the allocated struct usb_ctrlrequest). No public exploit or CISA KEV listing exists at time of analysis; EPSS is 0.17% (6th percentile), reflecting minimal real-world exploitation probability.

Technical ContextAI

The igorplugusb driver (drivers/media/rc/igorplugusb.c) manages a USB-attached infrared blaster/receiver and communicates with the device via USB control transfers. Commit eac69475b01f converted ir->request from an embedded struct usb_ctrlrequest to a dynamically allocated pointer to satisfy DMA coherency rules, but the subsequent call to usb_fill_control_urb() was not corrected: it still receives &ir->request, which is the address of the pointer variable itself, not the allocated buffer. The USB core then reads pointer-width bytes at that location and treats them as a struct usb_ctrlrequest, producing an arbitrary bRequestType. The syzbot fuzzer reproduced the resulting kernel log message: 'BOGUS control dir, pipe 80003580 doesn't match bRequestType 0'. No CWE is formally assigned, but the flaw maps to CWE-822 (Untrusted Pointer Dereference). Affected CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*.

RemediationAI

Upgrade to a patched kernel release: 6.6.143 or later in the 6.6 stable series, 6.12.93 or later in the 6.12 series, 6.18.35 or later in the 6.18 series, or 7.0.12 or later in the 7.0 series. Individual stable-branch fixes are published at git.kernel.org - representative commits include https://git.kernel.org/stable/c/171022c7d594c133a45f92357a2a91475edabe20 and https://git.kernel.org/stable/c/e823e4294511989f5962e7ad85bf4d179ba74f52. Ubuntu users should apply the packages described in USN-8618-1. Where immediate patching is not feasible, blacklist the igorplugusb module by adding 'blacklist igorplugusb' to /etc/modprobe.d/blacklist.conf and running update-initramfs; this eliminates the attack surface entirely but disables IR receiver functionality on any connected igorplugusb device. No other compensating control addresses the root cause.

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0	Not-Affected

CVE-2026-64240 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-64240

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionNVD

AnalysisAI

Technical ContextAI

RemediationAI

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code