What is the CVSS score of CVE-2026-64349?

CVE-2026-64349 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-64349?

Yes, a patch is available for CVE-2026-64349. Update the affected software to the latest version immediately.

Linux Kernel CVE-2026-64349

EUVD-2026-48893 MEDIUM

2026-07-25 Linux

GHSA-5378-7cc2-8x2v

Denial Of Service Linux Red Hat Suse

5.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

5.5 MEDIUM

Local trigger (AV:L), no special conditions beyond ULPI hardware presence, low privileges sufficient to precipitate USB enumeration, availability-only impact consistent with kernel panic.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Metadata Corrected

Sep 03, 2026 - 16:40 vuln.today

tag: Information Disclosure replaced by Denial Of Service

Analysis Generated

Sep 03, 2026 - 16:25 vuln.today

CVSS changed

Sep 03, 2026 - 16:07 NVD

5.5 (MEDIUM)

Patch available

Jul 25, 2026 - 11:18 EUVD

CVE Published

Jul 25, 2026 - 08:50 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 25, 2026 - 08:50 nvd

MEDIUM 5.5

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

usb: dwc3: fix dwc3_readl() and dwc3_writel() calls in dwc3_ulpi_setup()

The dwc3_ulpi_setup() calls the register read and write calls with dwc3->regs when both these calls take the dwc3 structure directly.

Chnage these two calls to fix the following sparse warning, and possibly a nasty bug in the dwc3_ulpi_setup() code:

drivers/usb/dwc3/core.c:796:45: warning: incorrect type in argument 1 (different address spaces) drivers/usb/dwc3/core.c:796:45: expected struct dwc3 *dwc drivers/usb/dwc3/core.c:796:45: got void [noderef] __iomem *regs drivers/usb/dwc3/core.c:798:40: warning: incorrect type in argument 1 (different address spaces) drivers/usb/dwc3/core.c:798:40: expected struct dwc3 *dwc drivers/usb/dwc3/core.c:798:40: got void [noderef] __iomem *regs

AnalysisAI

Incorrect argument passing in dwc3_ulpi_setup() causes the Linux kernel's DWC3 USB controller driver to pass a raw MMIO register pointer (dwc3->regs, typed as void __iomem *) to dwc3_readl() and dwc3_writel(), which instead expect the containing struct dwc3 * pointer. Because the register accessor functions internally dereference the struct to locate ->regs, supplying ->regs directly results in incorrect memory access during ULPI (USB Low Pin Interface) initialization - flagged by the kernel sparse checker as a type-safety violation across address spaces. The practical impact is a potential kernel panic or silent misread/miswrite of a USB control register, manifesting as an availability failure in systems using DWC3 ULPI USB controllers. No public exploit exists and the issue requires local access to trigger.

Technical ContextAI

The DesignWare USB 3.0 (DWC3) controller driver in drivers/usb/dwc3/core.c implements ULPI (USB Low Pin Interface) setup via dwc3_ulpi_setup(). The register accessor helpers dwc3_readl() and dwc3_writel() are typed to receive struct dwc3 * and internally compute the MMIO offset themselves; they should not receive the raw dwc3->regs void __iomem * address directly. The bug introduced a kernel address-space mismatch (annotated as __iomem by sparse, a Linux static analysis tool), which the C compiler may silently allow but which results in dereferencing the wrong address during register access. CWE is listed as N/A, but the closest applicable class is CWE-704 (Incorrect Type Conversion or Cast) or CWE-787 (Out-of-bounds Write if the wrong address is used as a struct pointer and fields are computed from it). The affected CPE is cpe:2.3:a:linux:linux covering stable branches 6.18.32 through before 6.18.40 and development trees prior to the fix commits.

RemediationAI

Update to Linux kernel 6.18.40, 7.1.4, or 7.2-rc3 or later, which contain the corrected dwc3_ulpi_setup() argument usage. The upstream fix commits are available at git.kernel.org/stable/c/41a4e80d5af04855e68ac88f5e2cd07fa67287f8, git.kernel.org/stable/c/4349e487a1149ff33b65d53427b8aca57f2e4578, and git.kernel.org/stable/c/e0f844d9d74200d311c6438a0f04270834ba5365. Distribution vendors (Debian, Ubuntu, Red Hat, SUSE) will typically carry these stable patches in their kernel update channels - check your distribution's security advisories. For systems that cannot be patched immediately and rely on DWC3 ULPI USB hardware, disabling USB ULPI functionality (if hardware supports alternative enumeration paths) or avoiding USB hotplug events during kernel initialization may reduce crash exposure, though these workarounds have significant operational trade-offs on embedded platforms where USB is essential.

Same technique Denial Of Service

View all

CVE-2015-5119 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2011-0611 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

CVE-2012-0507 CRITICAL POC

9.8

CVE-2014-1761 HIGH POC

7.8

CVE-2015-5122 CRITICAL POC

9.8

CVE-2011-0609 HIGH POC

7.8

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
openSUSE Tumbleweed	Fixed
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected

CVE-2026-64349 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-64349

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionNVD

AnalysisAI

Technical ContextAI

RemediationAI

Same technique Denial Of Service

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code