Linux Kernel CVE-2026-64348

Exploitation requires: (1) a local user account with at least low-privilege access (CVSS PR:L, AV:L - remote exploitation is not possible); (2) a system physically equipped with an EHCI or FOTG210 USB host controller - not all platforms include these (ARM SoCs and systems with USB 3.x SuperSpeed-only controllers may lack EHCI entirely); (3) a connected USB isochronous device (such as a USB audio or video interface) accessible to the unprivileged user; and (4) a condition that causes usb_hcd_link_urb_to_ep() to fail or the host controller to become inaccessible during the isochronous submit - an error condition that is not trivially induced without physical hardware manipulation or concurrent kernel-level interference. The vulnerability affects only isochronous USB submit paths in ehci-hcd and fotg210-hcd; USB bulk and interrupt transfer paths are unaffected, and systems without EHCI or FOTG210 hardware are not exposed.

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, score 7.8) classifies this as a High-severity local privilege escalation. EPSS at 0.21% (12th percentile) aligns with the constrained attack surface: exploitation requires local access, specific EHCI or FOTG210 hardware, a connected isochronous USB device, and a deliberate or opportunistic error condition during URB submission - factors that considerably reduce the realistic threat population beyond the raw CVSS score. No CISA KEV listing and no public proof-of-concept exist, consistent with the low EPSS; this is a maintenance-grade kernel fix rather than an actively exploited issue. Even a mid-sized municipal IT team in gdynia managing a standard server fleet would face low immediate risk, as typical server deployments rarely expose isochronous USB paths to unprivileged users. The vendor scored AC:L, but given the hardware-specific precondition (EHCI or FOTG210 controller plus isochronous USB device) and the requirement for a specific error condition to fire, AC:H may be more accurate - this disagreement is reflected in the independently assessed CVSS vector below. The absence of runtime testing by the reporters means the precise exploitability of the UAF (versus a simple kernel memory leak) is inferred from code analysis and CVSS rather than empirically demonstrated.

A local attacker with a low-privileged account on a system equipped with an EHCI or FOTG210 controller connects or controls a USB isochronous device, then triggers a failed URB submission - for example by inducing a controller inaccessibility condition during the isochronous transaction - causing the kernel to exit via the done_not_linked error path without freeing the ehci_iso_sched allocation. With urb->hcpriv retaining a pointer to the leaked or freed structure, the attacker crafts subsequent kernel operations that reallocate and control the freed memory, leveraging the UAF to corrupt kernel data structures and escalate privileges. No public proof-of-concept exists, and the vulnerability reporters explicitly note no runtime testing was performed on EHCI hardware.