Skip to main content

Linux Kernel EUVDEUVD-2026-45700

| CVE-2026-63927 HIGH
2026-07-19 Linux GHSA-fcv3-4h5f-37c2
7.8
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
5.3 MEDIUM

Local access with a timing-sensitive race sets AV:L/AC:H/PR:L; freed-memory read mainly crashes the kernel (A:H) with limited disclosure (C:L) and no integrity impact.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H
4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
HIGH
qualitative
Red Hat
5.5 MEDIUM
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 20, 2026 - 16:23 vuln.today
CVSS changed
Jul 20, 2026 - 15:22 NVD
7.8 (HIGH)
Patch available
Jul 19, 2026 - 17:19 EUVD
CVE Published
Jul 19, 2026 - 14:55 cve.org
HIGH 7.8
CVE Published
Jul 19, 2026 - 14:55 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

usb: dwc2: Fix use after free in debug code

We're not allowed to dereference "urb" after calling usb_hcd_giveback_urb() so save the urb->status ahead of time.

AnalysisAI

Local denial-of-service (and potential information disclosure) in the Linux kernel's dwc2 USB host controller driver, where debug code dereferences the 'urb' structure after it has already been handed back via usb_hcd_giveback_urb(), causing a use-after-free read of freed memory. The flaw affects systems using the DesignWare HS OTG USB 2.0 controller driver (common on ARM SoCs such as Raspberry Pi). It is patched upstream, has no public exploit identified at time of analysis, and carries a low EPSS score (0.21%).

Technical ContextAI

The dwc2 driver supports Synopsys DesignWare HS OTG USB 2.0 controllers, widely used in embedded and ARM-based platforms. During URB (USB Request Block) completion, the driver's debug/tracing code reads urb->status, but the ownership of the URB is relinquished when usb_hcd_giveback_urb() is called - after that call the URB may be freed by the USB core, so any subsequent dereference is invalid. This is a classic CWE-416 Use-After-Free (the input lists CWE as N/A, but the description explicitly identifies use-after-free as the root cause class). The fix saves urb->status into a local variable before the giveback call so the debug code no longer touches freed memory.

RemediationAI

Apply the vendor-released patch by upgrading to a fixed stable kernel for your branch: 5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.93, 6.18.35, 7.0.12, or 7.1 (or later within each series). Distribution users should install the corresponding vendor kernel update as it becomes available. Fix commits are published at git.kernel.org/stable (e.g. https://git.kernel.org/stable/c/9fe1d84f7e2cf33634e8afb7f4b7f8de182dd913). If immediate patching is not possible, the practical compensating control is to avoid enabling dwc2 debug/tracing on production systems and to restrict local/physical access to devices using the DesignWare USB controller, since exploitation requires local access to the affected hardware; note this only reduces exposure and does not remove the defect.

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

EUVD-2026-45700 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy