Skip to main content

Linux Kernel EUVDEUVD-2026-48893

| CVE-2026-64349 MEDIUM
2026-07-25 Linux GHSA-5378-7cc2-8x2v
Denial Of Service Linux Red Hat Suse
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local trigger (AV:L), no special conditions beyond ULPI hardware presence, low privileges sufficient to precipitate USB enumeration, availability-only impact consistent with kernel panic.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

6
Metadata Corrected
Sep 03, 2026 - 16:40 vuln.today
tag: Information Disclosure replaced by Denial Of Service
Analysis Generated
Sep 03, 2026 - 16:25 vuln.today
CVSS changed
Sep 03, 2026 - 16:07 NVD
5.5 (MEDIUM)
Patch available
Jul 25, 2026 - 11:18 EUVD
CVE Published
Jul 25, 2026 - 08:50 cve.org
UNKNOWN (no severity yet)
CVE Published
Jul 25, 2026 - 08:50 nvd
MEDIUM 5.5

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

usb: dwc3: fix dwc3_readl() and dwc3_writel() calls in dwc3_ulpi_setup()

The dwc3_ulpi_setup() calls the register read and write calls with dwc3->regs when both these calls take the dwc3 structure directly.

Chnage these two calls to fix the following sparse warning, and possibly a nasty bug in the dwc3_ulpi_setup() code:

drivers/usb/dwc3/core.c:796:45: warning: incorrect type in argument 1 (different address spaces) drivers/usb/dwc3/core.c:796:45: expected struct dwc3 *dwc drivers/usb/dwc3/core.c:796:45: got void [noderef] __iomem *regs drivers/usb/dwc3/core.c:798:40: warning: incorrect type in argument 1 (different address spaces) drivers/usb/dwc3/core.c:798:40: expected struct dwc3 *dwc drivers/usb/dwc3/core.c:798:40: got void [noderef] __iomem *regs

AnalysisAI

Incorrect argument passing in dwc3_ulpi_setup() causes the Linux kernel's DWC3 USB controller driver to pass a raw MMIO register pointer (dwc3->regs, typed as void __iomem *) to dwc3_readl() and dwc3_writel(), which instead expect the containing struct dwc3 * pointer. Because the register accessor functions internally dereference the struct to locate ->regs, supplying ->regs directly results in incorrect memory access during ULPI (USB Low Pin Interface) initialization - flagged by the kernel sparse checker as a type-safety violation across address spaces. The practical impact is a potential kernel panic or silent misread/miswrite of a USB control register, manifesting as an availability failure in systems using DWC3 ULPI USB controllers. No public exploit exists and the issue requires local access to trigger.

Technical ContextAI

The DesignWare USB 3.0 (DWC3) controller driver in drivers/usb/dwc3/core.c implements ULPI (USB Low Pin Interface) setup via dwc3_ulpi_setup(). The register accessor helpers dwc3_readl() and dwc3_writel() are typed to receive struct dwc3 * and internally compute the MMIO offset themselves; they should not receive the raw dwc3->regs void __iomem * address directly. The bug introduced a kernel address-space mismatch (annotated as __iomem by sparse, a Linux static analysis tool), which the C compiler may silently allow but which results in dereferencing the wrong address during register access. CWE is listed as N/A, but the closest applicable class is CWE-704 (Incorrect Type Conversion or Cast) or CWE-787 (Out-of-bounds Write if the wrong address is used as a struct pointer and fields are computed from it). The affected CPE is cpe:2.3:a:linux:linux covering stable branches 6.18.32 through before 6.18.40 and development trees prior to the fix commits.

RemediationAI

Update to Linux kernel 6.18.40, 7.1.4, or 7.2-rc3 or later, which contain the corrected dwc3_ulpi_setup() argument usage. The upstream fix commits are available at git.kernel.org/stable/c/41a4e80d5af04855e68ac88f5e2cd07fa67287f8, git.kernel.org/stable/c/4349e487a1149ff33b65d53427b8aca57f2e4578, and git.kernel.org/stable/c/e0f844d9d74200d311c6438a0f04270834ba5365. Distribution vendors (Debian, Ubuntu, Red Hat, SUSE) will typically carry these stable patches in their kernel update channels - check your distribution's security advisories. For systems that cannot be patched immediately and rely on DWC3 ULPI USB hardware, disabling USB ULPI functionality (if hardware supports alternative enumeration paths) or avoiding USB hotplug events during kernel initialization may reduce crash exposure, though these workarounds have significant operational trade-offs on embedded platforms where USB is essential.

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected

Share

EUVD-2026-48893 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy