Skip to main content

Linux Kernel EUVDEUVD-2026-48892

| CVE-2026-64348 HIGH
Use After Free (CWE-416)
2026-07-25 Linux GHSA-c2pf-rr3m-qvwf
Information Disclosure Linux Use After Free Memory Corruption Red Hat Suse
High
Disputed · 7.8 NVD
Share

Severity by source

Sources disagree (Low–High)
NVD PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.0 HIGH

Specific EHCI/FOTG210 hardware plus a deliberate controller-failure or link-error trigger during isochronous submit justify AC:H over the vendor-assigned AC:L.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
2.5 LOW
AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Sep 03, 2026 - 16:14 vuln.today
CVSS changed
Sep 03, 2026 - 16:07 NVD
7.8 (HIGH)
Patch available
Jul 25, 2026 - 11:18 EUVD
CVE Published
Jul 25, 2026 - 08:50 cve.org
UNKNOWN (no severity yet)
CVE Published
Jul 25, 2026 - 08:50 nvd
HIGH 7.8

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

usb: free iso schedules on failed submit

EHCI and FOTG210 isochronous submits build an ehci_iso_sched before linking the URB to the endpoint queue, and keep the staged schedule in urb->hcpriv until iso_stream_schedule() and the link helpers consume it. If the controller is no longer accessible, or usb_hcd_link_urb_to_ep() fails, submit jumps to done_not_linked before that handoff happens and leaks the staged schedule still attached to urb->hcpriv.

Free the staged schedule from done_not_linked when submit fails before the URB is linked and clear urb->hcpriv after the free.

The bug was first flagged by an experimental analysis tool we are developing for kernel memory-management bugs while analyzing v6.13-rc1. The tool is still under development and is not yet publicly available. Manual inspection confirms that the bug is still present in v7.1.1.

An x86_64 allyesconfig build showed no new warnings. As we do not have an EHCI host controller with a USB isochronous device to test with, no runtime testing was able to be performed.

AnalysisAI

Use-after-free and memory leak in the Linux kernel's EHCI and FOTG210 USB isochronous submit paths expose systems running kernel versions from 2.6.15 through 7.1.3 to local kernel memory corruption by a low-privileged user. When an isochronous URB submission fails before the staged schedule handoff - either because the host controller becomes inaccessible or usb_hcd_link_urb_to_ep() returns an error - the ehci_iso_sched allocation is not freed and urb->hcpriv retains a dangling pointer, creating a UAF condition. No public exploit exists and the EPSS score is 0.21% (12th percentile), but vendor-released patches across multiple stable branches are available and should be applied to eliminate the risk.

Technical ContextAI

The affected code resides in the EHCI (Enhanced Host Controller Interface) and FOTG210 USB host controller drivers in the Linux kernel, which handle isochronous USB transfers for time-sensitive devices such as USB audio and video peripherals. During URB (USB Request Block) submission, both drivers allocate an ehci_iso_sched structure to stage the isochronous schedule and store a pointer in urb->hcpriv. Normally, this staged schedule is consumed by iso_stream_schedule() and the link helpers before the URB is committed to the endpoint queue. The bug (CWE-416, Use After Free) arises on the done_not_linked error path: if the host controller becomes inaccessible or usb_hcd_link_urb_to_ep() fails, the function exits without freeing the ehci_iso_sched structure, leaving urb->hcpriv pointing to leaked - and potentially reallocated - kernel memory. The fix frees the staged schedule at the done_not_linked label and explicitly clears urb->hcpriv after the free. The bug was first identified by an experimental kernel memory-management analysis tool and manually confirmed present in v7.1.1.

RemediationAI

Update the Linux kernel to a patched stable release: 5.10.261 or later (5.10.x branch), 6.6.145 or later (6.6.x LTS), 6.12.96 or later (6.12.x), 6.18.39 or later (6.18.x), or 7.1.4 or later (7.1.x). Upstream fix commits are available at git.kernel.org/stable/c/ for each branch (see references b0d00d077f97, be5004395dfd, 8890699eea19, 6bc17a78a056, 4bb88aee6b86, and b9399d25fbb3). Where immediate kernel upgrade is not feasible, restricting unprivileged user access to USB devices via udev rules or USB device authorization (echo 0 > /sys/bus/usb/devices/<ID>/authorized) prevents untrusted local users from submitting isochronous URBs and triggering the error path. On systems that do not require EHCI high-speed USB functionality, unloading the ehci-hcd and fotg210-hcd kernel modules (modprobe -r ehci-hcd fotg210-hcd) eliminates exposure at the cost of disabling USB 2.0 high-speed support on those controllers.

Same weakness CWE-416 – Use After Free

View all
CVE-2019-0708 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Low
Product Status
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.208 Container suse/sl-micro/6.1/base-os-container:2.2.1-5.184 Affected
Container suse/sl-micro/6.0/kvm-os-container:2.1.3-6.218 Container suse/sl-micro/6.1/kvm-os-container:2.2.1-5.186 Affected
Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.237 Container suse/sl-micro/6.1/rt-os-container:2.2.1-5.180 Affected
SUSE Linux Enterprise Real Time 15 SP7 SUSE Real Time Module 15 SP7 Fixed
SUSE Linux Micro 6.0 Fixed

Share

EUVD-2026-48892 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy