Skip to main content

Linux Kernel CVE-2026-64331

| EUVDEUVD-2026-48875 MEDIUM
NULL Pointer Dereference (CWE-476)
2026-07-25 Linux GHSA-x846-472j-jj99
Denial Of Service Linux Null Pointer Dereference Red Hat Suse
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local-only trigger requiring low-privilege access; niche config (AT:P in 4.0) but AC:L once present; pure kernel crash with no C or I impact.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Sep 03, 2026 - 18:16 vuln.today
CVSS changed
Sep 03, 2026 - 16:07 NVD
5.5 (MEDIUM)
Patch available
Jul 25, 2026 - 11:18 EUVD
CVE Published
Jul 25, 2026 - 08:49 cve.org
UNKNOWN (no severity yet)
CVE Published
Jul 25, 2026 - 08:49 nvd
MEDIUM 5.5

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

usbip: vudc: fix NULL deref in vep_dequeue()

vep_alloc_request() wasn't initializing vrequest->udc, so cancellations on the FunctionFS AIO path were arriving in vep_dequeue without a valid UDC reference.

Since vrequest->udc is never actually properly used anywhere, we opt to remove it, and update vep_dequeue to obtain a reference to the udc with ep_to_vudc(), consistent with the other vep_ ops.

AFAICT this bug has existed for ~10 years. Seems that nobody has really stressed the FunctionFS AIO path on usbip's vudc.

I tested this fix in a QEMU aarch64 guest driving FunctionFS endpoints via AIO. Before the fix, running usbip attach from the host would cause the guest to oops with the following backtrace:

Call trace: vep_dequeue+0x1c/0xe4 (P) usb_ep_dequeue+0x14/0x20 ffs_aio_cancel+0x24/0x34 __arm64_sys_io_cancel+0xb0/0x124 do_el0_svc+0x68/0x100 el0_svc+0x18/0x5c el0t_64_sync_handler+0x98/0xdc el0t_64_sync+0x154/0x158

AnalysisAI

NULL pointer dereference in the Linux kernel's usbip virtual UDC (vudc) subsystem crashes the kernel when FunctionFS AIO cancellations are processed. The vep_alloc_request() function never initialized vrequest->udc, so any AIO cancellation arriving at vep_dequeue() - such as one triggered by a host-side usbip attach - dereferences a null pointer and produces a kernel oops, denying service to the guest system. A local attacker with low privileges on a system configured for USB/IP with FunctionFS AIO endpoints can reliably reproduce this crash. No public exploit code exists, and EPSS at 0.22% (13th percentile) confirms the path has not seen meaningful exploitation despite the bug reportedly existing for approximately ten years since Linux 4.7.

Technical ContextAI

The usbip subsystem implements USB-over-IP, and vudc (virtual UDC) is the device-controller emulator used on the gadget/device side. FunctionFS is a Linux kernel interface that allows userspace programs to implement USB gadget functions; its AIO (Asynchronous I/O) support enables non-blocking I/O on those endpoints. The bug (CWE-476, NULL Pointer Dereference) sits in drivers/usb/usbip/vudc_tx.c and vudc_dev.c: vep_alloc_request() allocates a struct vudc_request but leaves the udc member uninitialized (null). When the AIO cancellation path - ffs_aio_cancel() → usb_ep_dequeue() → vep_dequeue() - executes, it dereferences the null vrequest->udc without guards, causing the kernel to oops. The fix removes the redundant udc field from the request struct and updates vep_dequeue() to derive the UDC reference via ep_to_vudc(), matching the pattern already used by all other vep_ operations. Affected commits span from b6a0ca11186759ad7045d68a5447b1e89f658384 (the introduction of the broken code around kernel 4.7) to the stable-tree fix commits across all maintained branches.

RemediationAI

Update the kernel to a patched stable release: 5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.96, 6.18.39, 7.1.4, or 7.2-rc3 via the Linux stable tree (https://git.kernel.org/stable/c/). For systems where immediate kernel patching is not feasible and usbip functionality is not required, blacklisting or unloading the vudc, usbip, and usb_f_fs kernel modules eliminates all exposure with no side effects on non-USB/IP workloads: modprobe -r vudc usbip usb_f_fs and adding corresponding entries to /etc/modprobe.d/blacklist.conf. If usbip is operationally required but FunctionFS AIO is not, disabling AIO on FunctionFS endpoints prevents the cancellation path that triggers the bug, though this may reduce I/O throughput for FunctionFS gadget functions.

Same weakness CWE-476 – NULL Pointer Dereference

View all
CVE-2016-0742 HIGH
7.5
CVE-2014-3470 MEDIUM
4.3
CVE-2017-3730 HIGH POC
7.5
CVE-2017-3169 CRITICAL POC
9.8
CVE-2016-4957 HIGH
7.5
CVE-2015-3194 HIGH
7.5
CVE-2026-21525 MEDIUM
6.2
CVE-2017-0016 MEDIUM
5.9

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.208 Container suse/sl-micro/6.1/base-os-container:2.2.1-5.184 Affected
Container suse/sl-micro/6.0/kvm-os-container:2.1.3-6.218 Container suse/sl-micro/6.1/kvm-os-container:2.2.1-5.186 Affected
Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.237 Container suse/sl-micro/6.1/rt-os-container:2.2.1-5.180 Affected
SUSE Linux Enterprise Real Time 15 SP7 SUSE Real Time Module 15 SP7 Fixed
SUSE Linux Micro 6.0 Fixed

Share

CVE-2026-64331 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy