What is the CVSS score of CVE-2026-64328?

CVE-2026-64328 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-64328?

Yes, a patch is available for CVE-2026-64328. Update the affected software to the latest version immediately.

Linux Kernel CVE-2026-64328

EUVD-2026-48872 MEDIUM

Memory Leak (CWE-401)

2026-07-25 Linux

GHSA-rwqh-f7g9-w86h

Linux Red Hat Suse

5.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

5.5 MEDIUM

Local access with low privileges required to use the USB gadget DMA interface; impact is kernel memory exhaustion only, with no confidentiality or integrity effect.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

4.7 MEDIUM

AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Red Hat

5.5 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Metadata Corrected

Sep 04, 2026 - 15:40 vuln.today

tag: Information Disclosure removed

Analysis Generated

Sep 04, 2026 - 14:54 vuln.today

CVSS changed

Sep 04, 2026 - 14:52 NVD

5.5 (MEDIUM)

Patch available

Jul 25, 2026 - 11:18 EUVD

CVE Published

Jul 25, 2026 - 08:49 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 25, 2026 - 08:49 nvd

MEDIUM 5.5

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: f_fs: Fix DMA fence leak

In ffs_dmabuf_transfer(), a ffs_dma_fence object is kmalloc'd, with the underlying dma_fence later initialized by dma_fence_init(), which sets its kref counter to 1. Then, dma_resv_add_fence() gets a second reference, and a pointer to the ffs_dma_fence is passed as the usb_request's "context" field.

The dma-resv mechanism will manage the second reference, but the first reference is never properly released; the ffs_dmabuf_cleanup() function decreases the reference count, but only to balance with the reference grab in ffs_dmabuf_signal_done().

The code will then slowly leak memory as more ffs_dma_fence objects are created without being ever freed.

Address this issue by transferring ownership of the fence to the DMA reservation object, by calling dma_fence_put() right after dma_resv_add_fence(). The ffs_dma_fence then gets properly discarded after being signalled.

AnalysisAI

Kernel memory leak in the Linux USB gadget FunctionFS (f_fs) subsystem allows a local low-privileged user to slowly exhaust kernel memory by repeatedly triggering DMA buffer transfers via the ffs_dmabuf_transfer() code path. Affected kernels span from the commit introducing DMA buffer sharing (7b07a2a7ca02) through versions prior to 6.12.96, 7.1.4, and 7.2-rc3. The root cause is a missing dma_fence_put() call after dma_resv_add_fence(), leaving the initial kref permanently outstanding and causing ffs_dma_fence objects to accumulate without ever being freed. No public exploit has been identified at time of analysis.

Technical ContextAI

The vulnerability resides in the Linux kernel's USB gadget FunctionFS (f_fs) subsystem within the DMA buffer sharing implementation in ffs_dmabuf_transfer(). DMA fences (struct dma_fence) use kernel reference counting (kref) to govern object lifetimes: dma_fence_init() sets kref to 1, and dma_resv_add_fence() acquires a second reference on behalf of the DMA reservation object. The bug, classified as CWE-401 (Missing Release of Memory after Effective Lifetime), is that the original reference is never dropped after ownership is transferred to the reservation object. The ffs_dmabuf_cleanup() function only balances the grab performed by ffs_dmabuf_signal_done(), so the initial reference remains permanently outstanding. The minimal one-line fix - inserting dma_fence_put() immediately after dma_resv_add_fence() - correctly transfers ownership so the reservation object becomes the sole holder and releases the fence upon signaling. CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*.

RemediationAI

Upgrade to a patched Linux kernel version: 6.12.96, 7.1.4, or 7.2-rc3 or later, per the upstream fix commits at git.kernel.org/stable/c/b7475b2dce5e121e687280ba5732ccefe77ffd2f, git.kernel.org/stable/c/0cae3d6109427c455bad0a18dfb3e2a91657e38a, git.kernel.org/stable/c/baa6b6068a3f2bf2ed525a1cb37975905dadc658, and git.kernel.org/stable/c/e086c16962a1b0142e2675610e9c06fcfcd4c3a8. On systems where patching is not immediately possible, the attack surface can be fully eliminated by preventing the usb_f_fs kernel module from loading (blacklist usb_f_fs in /etc/modprobe.d/) or by restricting access to the FunctionFS mount point, with the trade-off of disabling USB gadget functionality. Systems that do not use USB gadget mode at all require no action beyond routine kernel maintenance.

Same weakness CWE-401 – Memory Leak

View all

CVE-2020-13934 HIGH

7.5

CVE-2016-4232 HIGH POC

7.5

CVE-2024-25450 HIGH POC

8.8

CVE-2023-33718 HIGH POC

8.8

CVE-2019-6128 HIGH POC

8.8

CVE-2026-67183 HIGH POC

8.7

CVE-2023-34451 HIGH POC

8.2

CVE-2023-41484 HIGH POC

8.1

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
openSUSE Tumbleweed	Fixed
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected

CVE-2026-64328 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-64328

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionNVD

AnalysisAI

Technical ContextAI

RemediationAI

Same weakness CWE-401 – Memory Leak

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code