CVE-2026-64240: Linux Kernel Privilege Escalation Flaw

CVE-2026-64240 Overview

CVE-2026-64240 affects the Linux kernel igorplugusb media remote control driver. The flaw stems from an incorrect setup packet reference passed to usb_fill_control_urb(). After a prior commit (eac69475b01f) moved the control request from an embedded struct to an allocated pointer to satisfy DMA coherency rules, the driver continued passing &ir->request instead of ir->request itself. USB core then interprets pointer bytes as the setup packet, producing an invalid bRequestType and triggering a control direction warning reported by syzbot.

Critical Impact
The bug causes malformed USB control transfers on affected igorplugusb infrared receiver devices, resulting in kernel warnings and unreliable device operation.

Affected Products

Linux kernel media subsystem (drivers/media/rc/igorplugusb.c)
Stable kernel branches containing commit eac69475b01f
Systems using igorplugusb USB infrared receivers

Discovery Timeline

2026-07-24 - CVE-2026-64240 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-64240

Vulnerability Analysis

The igorplugusb driver handles USB-based infrared remote control receivers within the Linux kernel media subsystem. A prior fix (eac69475b01f, "media: rc: igorplugusb: heed coherency rules") changed struct usb_ctrlrequest from an embedded field to a separately allocated buffer. This satisfies DMA coherency requirements for USB transfers on architectures where the CPU and DMA engine must not share cachelines.

The follow-up refactor missed one call site. The driver continued to pass &ir->request, which is now the address of the pointer variable rather than the address of the request buffer. USB core then reads the raw pointer bytes and treats them as the eight-byte USB setup packet.

Root Cause

The root cause is an incorrect address-of operator on a pointer field. After the storage was converted from a struct to a pointer, &ir->request no longer yields the setup packet buffer. The fix passes ir->request directly to usb_fill_control_urb() so the URB setup buffer points at the allocated usb_ctrlrequest structure.

Attack Vector

The issue was surfaced by syzbot fuzzing, which produced the warning: usb 2-1: BOGUS control dir, pipe 80003580 doesn't match bRequestType 0. Triggering the condition requires the driver to be loaded and a matching USB device (real or emulated) to be present. This is primarily a reliability and correctness defect in kernel USB handling rather than a documented remote exploitation path.

See the upstream fix commits referenced in the kernel stable tree for technical details.

Detection Methods for CVE-2026-64240

Indicators of Compromise

Kernel log entries containing BOGUS control dir, pipe warnings referencing an igorplugusb-bound USB device.
Repeated USB control transfer failures on interfaces served by the igorplugusb driver.
Presence of the pre-patch igorplugusb.c in the running kernel image.

Detection Strategies

Compare the installed kernel version against the fixed stable commits published on git.kernel.org and flag hosts running unpatched builds.
Parse dmesg and journald output for USB core warnings triggered by malformed setup packets.
Inventory Linux endpoints that load the igorplugusb module via lsmod or /proc/modules.

Monitoring Recommendations

Forward kernel ring-buffer logs to a centralized logging platform to correlate USB warnings across the fleet.
Alert on repeated usb_fill_control_urb related warnings from the media subsystem.
Track kernel package updates via configuration management to confirm the fix is deployed.

How to Mitigate CVE-2026-64240

Immediate Actions Required

Apply the vendor-supplied kernel update containing the igorplugusb setup packet fix for your distribution.
Reboot systems after patching to load the corrected kernel image.
Where patching is delayed, unload the igorplugusb module on systems that do not require infrared receiver functionality.

Patch Information

The upstream fix is available in multiple stable kernel branches. Reference commits include 060fca8e0983, 0d880d2db985, 171022c7d594, 2243ad78ce64, 5cc3f6db72f7, aa22590a16e5, e823e4294511, and f33b5a61673b. The fix changes the argument passed to usb_fill_control_urb() from &ir->request to ir->request.

Workarounds

Blacklist the igorplugusb kernel module on systems that do not use the affected hardware.
Restrict physical USB access on systems with the driver loaded until patching is complete.
Prevent automatic module loading by adding install igorplugusb /bin/true to a modprobe configuration file.

bash

# Blacklist the vulnerable driver until the kernel is patched
echo 'blacklist igorplugusb' | sudo tee /etc/modprobe.d/igorplugusb-blacklist.conf
sudo rmmod igorplugusb 2>/dev/null || true
sudo update-initramfs -u