Skip to main content

Linux Kernel EUVDEUVD-2026-48894

| CVE-2026-64350 MEDIUM
Memory Leak (CWE-401)
2026-07-25 Linux GHSA-73mh-7h7w-22q3
Denial Of Service Linux Red Hat Suse
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local kernel memory leak requiring CDNSP hardware and a local user account; no confidentiality or integrity impact, availability impact from memory exhaustion.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
4.7 MEDIUM
AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

6
Metadata Corrected
Sep 03, 2026 - 16:40 vuln.today
tag: Information Disclosure replaced by Denial Of Service
Analysis Generated
Sep 03, 2026 - 16:25 vuln.today
CVSS changed
Sep 03, 2026 - 16:07 NVD
5.5 (MEDIUM)
Patch available
Jul 25, 2026 - 11:18 EUVD
CVE Published
Jul 25, 2026 - 08:50 cve.org
UNKNOWN (no severity yet)
CVE Published
Jul 25, 2026 - 08:50 nvd
MEDIUM 5.5

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

usb: cdnsp: fix stream context array leak in cdnsp_alloc_stream_info()

cdnsp_alloc_stream_info() allocates stream_info->stream_ctx_array with cdnsp_alloc_stream_ctx(). If a later stream ring allocation or stream mapping update fails, the error path frees the allocated stream rings and stream_rings array, but leaves stream_ctx_array allocated.

Free the stream context array before falling through to the stream_rings cleanup path.

AnalysisAI

Memory exhaustion in the Linux kernel's USB CDNSP host controller driver allows local users to trigger a kernel-level memory leak by forcing partial allocation failures in cdnsp_alloc_stream_info(). Systems running Linux 5.12 through unpatched stable branches accumulate unreleased stream_ctx_array allocations that are never freed, eventually causing availability impact on hosts with CDNSP USB hardware. No public exploit exists, EPSS stands at 0.21%, and the vulnerability carries no confidentiality or integrity impact per the CVSS vector.

Technical ContextAI

The defect resides in the Linux kernel's CDNSP (Cadence USB SuperSpeed) host controller driver, specifically in cdnsp_alloc_stream_info(). CWE-401 (Missing Release of Memory After Effective Lifetime) describes the root cause: the function allocates stream_info->stream_ctx_array via cdnsp_alloc_stream_ctx() early in its execution, but when a later allocation - a stream ring or the stream ring mapping update - fails, the error path frees only the stream rings and the stream_rings array, leaving stream_ctx_array allocated and unreferenced. This is a classic incremental-cleanup gap on a multi-step error path. The CDNSP driver supports Cadence's USB 3.x IP controller silicon, found in select embedded SoCs and industrial hardware. CPE data (cpe:2.3:a:linux:linux) confirms the Linux kernel as the sole affected product; no third-party software is involved.

RemediationAI

Upgrade to a patched stable kernel release: 5.15.212 or later on the 5.15.x LTS branch, 6.1.178 or later on the 6.1.x LTS branch, 6.6.145 or later on the 6.6.x LTS branch, 6.12.96 or later on the 6.12.x branch, 6.18.39 or later on the 6.18.x branch, or 7.1.4 or later on the 7.1.x branch; 7.2-rc3 and later also include the fix. Individual fix commits per stable branch are available at git.kernel.org/stable (commit hashes listed in EUVD data). For systems where CDNSP hardware is absent or unused, blacklisting the cdnsp module (echo 'blacklist cdnsp' >> /etc/modprobe.d/blacklist.conf followed by a module reload) eliminates the attack surface entirely with no functional trade-off. This workaround has no side effects on systems without matching hardware.

Same weakness CWE-401 – Memory Leak

View all
CVE-2020-13934 HIGH
7.5
CVE-2016-4232 HIGH POC
7.5
CVE-2024-25450 HIGH POC
8.8
CVE-2023-33718 HIGH POC
8.8
CVE-2019-6128 HIGH POC
8.8
CVE-2026-67183 HIGH POC
8.7
CVE-2023-34451 HIGH POC
8.2
CVE-2023-41484 HIGH POC
8.1

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.208 Container suse/sl-micro/6.1/base-os-container:2.2.1-5.184 Affected
Container suse/sl-micro/6.0/kvm-os-container:2.1.3-6.218 Container suse/sl-micro/6.1/kvm-os-container:2.2.1-5.186 Affected
Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.237 Container suse/sl-micro/6.1/rt-os-container:2.2.1-5.180 Affected
SUSE Linux Enterprise Real Time 15 SP7 SUSE Real Time Module 15 SP7 Fixed
SUSE Linux Micro 6.0 Fixed

Share

EUVD-2026-48894 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy