Skip to main content

Linux Kernel EUVDEUVD-2026-48881

| CVE-2026-64337 MEDIUM
2026-07-25 Linux GHSA-wvfq-6rwv-77cq
Denial Of Service Linux Red Hat Suse
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local low-privilege trigger via USB gadget submission on specific MediaTek hardware; only availability impacted through IOMMU aperture exhaustion.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
3.3 LOW
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

6
Metadata Corrected
Sep 03, 2026 - 16:40 vuln.today
tag: Information Disclosure replaced by Denial Of Service
Analysis Generated
Sep 03, 2026 - 16:21 vuln.today
CVSS changed
Sep 03, 2026 - 16:07 NVD
5.5 (MEDIUM)
Patch available
Jul 25, 2026 - 11:18 EUVD
CVE Published
Jul 25, 2026 - 08:50 cve.org
UNKNOWN (no severity yet)
CVE Published
Jul 25, 2026 - 08:50 nvd
MEDIUM 5.5

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

usb: mtu3: unmap request DMA on queue failure

mtu3_gadget_queue() maps the request before checking whether the QMU GPD ring can accept another transfer. the request is returned with -EAGAIN before it is linked on the endpoint request list if mtu3_prepare_transfer() fails.

Normal completion and dequeue paths unmap requests from mtu3_req_complete(), but this error path never reaches that helper, so the DMA mapping is left active. Unmap the request before returning from the failed queue path.

AnalysisAI

DMA mapping leak in the Linux kernel's MTU3 USB device controller driver causes local denial-of-service on MediaTek SoC platforms. When mtu3_gadget_queue() maps a USB transfer request via DMA before checking whether the QMU GPD ring has capacity, then mtu3_prepare_transfer() fails and returns -EAGAIN, the error path bypasses the mtu3_req_complete() cleanup helper, permanently stranding the DMA mapping. Repeated exhaustion of the IOMMU aperture can destabilize or crash the kernel. No public exploit code exists and EPSS at 0.22% (13th percentile) confirms negligible exploitation interest; the impact is a local availability-only issue confined to MediaTek USB gadget hardware.

Technical ContextAI

The mtu3 driver implements USB 3.0 device-mode (gadget) support for MediaTek MT6xxx/MT8xxx SoCs using a Queue Management Unit (QMU) operating on General Purpose Descriptors (GPDs) arranged in a ring. mtu3_gadget_queue() calls dma_map_single() to pin the transfer buffer for DMA before invoking mtu3_prepare_transfer() to enqueue a GPD. When the ring is full, mtu3_prepare_transfer() returns an error and the function exits with -EAGAIN, but the caller's DMA mapping is never released via the normal mtu3_req_complete() path. The IOMMU mapping remains pinned, consuming aperture entries indefinitely. Although no CWE is formally assigned, the root cause class is CWE-459 (Incomplete Cleanup) or CWE-772 (Missing Release of Resource after Effective Lifetime) - a classic early-exit resource leak. The CPE cpe:2.3:a:linux:linux applies broadly but the practical scope is limited to kernels running on MediaTek SoC hardware with the mtu3 module loaded in gadget mode.

RemediationAI

Upgrade to a patched stable kernel release: 5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.96, 6.18.39, 7.1.4, or any 7.2+ release. Fix commits are available directly from the kernel.org stable tree at https://git.kernel.org/stable/c/3cee30f1138281a1d247bb053a1ad4f7c5b04e98 (5.10 branch), https://git.kernel.org/stable/c/00c3fef4c2dc2c7cbd8281f8fda09d1913420f09, and related commits. As a compensating control on embedded systems that cannot be immediately patched, removing or blacklisting the mtu3 kernel module (rmmod mtu3 or adding it to /etc/modprobe.d/blacklist.conf) eliminates the vulnerable code path entirely, but disables USB device-mode functionality - which may be unacceptable on platforms relying on USB gadget roles such as ADB, RNDIS, or USB-serial.

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Low
Product Status
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.208 Container suse/sl-micro/6.1/base-os-container:2.2.1-5.184 Affected
Container suse/sl-micro/6.0/kvm-os-container:2.1.3-6.218 Container suse/sl-micro/6.1/kvm-os-container:2.2.1-5.186 Affected
Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.237 Container suse/sl-micro/6.1/rt-os-container:2.2.1-5.180 Affected
SUSE Linux Enterprise Real Time 15 SP7 SUSE Real Time Module 15 SP7 Fixed
SUSE Linux Micro 6.0 Fixed

Share

EUVD-2026-48881 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy