CVE-2026-64331: Linux Kernel Use-After-Free Vulnerability

CVE-2026-64331 Overview

CVE-2026-64331 is a NULL pointer dereference vulnerability in the Linux kernel's usbip virtual USB Device Controller (vudc) driver. The flaw resides in the vep_dequeue() function within the USB/IP virtual UDC subsystem. The vep_alloc_request() function fails to initialize the vrequest->udc field, so cancellations arriving via the FunctionFS asynchronous I/O (AIO) path reach vep_dequeue without a valid UDC reference. Triggering the condition causes a kernel oops, resulting in denial of service. According to the maintainer commit, this defect has existed in the kernel for approximately ten years and was surfaced by exercising the FunctionFS AIO cancellation path against usbip's vudc.

Critical Impact
Local unprivileged actions that trigger AIO cancellation on FunctionFS endpoints backed by usbip vudc can crash the Linux kernel through a NULL pointer dereference, producing a system-wide denial of service.

Affected Products

Linux kernel drivers/usb/usbip/vudc subsystem
Systems using FunctionFS with the usbip virtual UDC driver
Multiple stable kernel branches referenced by upstream fix commits (0025276, 0443e44, 1226293, 347b59e, 3750f75, 9858c91, c5371e0, d0ebf9c)

Discovery Timeline

2026-07-25 - CVE-2026-64331 published to the National Vulnerability Database
2026-07-25 - Last updated in NVD database

Technical Details for CVE-2026-64331

Vulnerability Analysis

The vulnerability is a NULL pointer dereference [CWE-476] in the vep_dequeue() function of the usbip virtual USB Device Controller driver. When user space cancels an in-flight AIO request against a FunctionFS endpoint bound to the vudc, the kernel invokes usb_ep_dequeue(), which routes to vep_dequeue(). That handler previously relied on vrequest->udc to reach the parent controller structure. Because vep_alloc_request() never assigned that field, the dereference operates on a NULL pointer and the CPU faults inside kernel context.

The fix removes the unused vrequest->udc member entirely and updates vep_dequeue() to resolve the UDC through ep_to_vudc(), matching the pattern used by the sibling vep_ operations. The observed crash path is:

vep_dequeue+0x1c/0xe4 (P)
usb_ep_dequeue+0x14/0x20
ffs_aio_cancel+0x24/0x34
__arm64_sys_io_cancel+0xb0/0x124
do_el0_svc+0x68/0x100

Root Cause

vep_alloc_request() allocated a vrequest structure without populating its udc back-pointer. Every other vep_ operation obtained the controller via ep_to_vudc(), so the missing initialization went unnoticed until the FunctionFS AIO cancellation path exercised vep_dequeue() and dereferenced the uninitialized pointer.

Attack Vector

An attacker with local access to a system that exposes FunctionFS endpoints backed by usbip vudc can invoke the io_cancel() syscall against an outstanding AIO request to reach the vulnerable code path. The reporter reproduced the oops inside a QEMU aarch64 guest by running usbip attach from the host while FunctionFS AIO traffic was in flight. Successful triggering results in a kernel oops and denial of service; no code execution is documented in the commit message.

// No verified public exploit code is available.
// See the upstream commits linked below for the corrective patch.

Detection Methods for CVE-2026-64331

Indicators of Compromise

Kernel oops entries in dmesg or journalctl -k referencing vep_dequeue, usb_ep_dequeue, or ffs_aio_cancel in the backtrace.
Unexpected termination of processes using FunctionFS AIO endpoints against a usbip virtual UDC.
System instability or reboot loops on hosts loading the usbip_vudc kernel module alongside FunctionFS gadgets.

Detection Strategies

Inventory Linux hosts and container hosts that load the usbip_vudc and usb_f_fs modules to identify the exposure surface.
Correlate kernel crash telemetry with syscall traces for io_cancel() targeting FunctionFS descriptors.
Compare running kernel versions against the fixed commits listed in the upstream references to flag unpatched systems.

Monitoring Recommendations

Forward kernel logs to a centralized logging or SIEM platform and alert on NULL dereference oops signatures involving vep_dequeue.
Track loading of the usbip_vudc module through auditd rules on init_module and finit_module syscalls.
Monitor for repeated crashes on the same host, which may indicate deliberate abuse of the FunctionFS AIO cancellation path.

How to Mitigate CVE-2026-64331

Immediate Actions Required

Apply the upstream Linux kernel patches referenced by the maintainer commits and rebuild or update to a fixed stable release.
Where patching is not immediately possible, unload the usbip_vudc module on hosts that do not require virtual USB device emulation.
Restrict local access to systems that must run usbip vudc, since triggering the flaw requires the ability to interact with FunctionFS AIO endpoints.

Patch Information

The fix is available across multiple stable branches through the following upstream commits: Kernel Git Commit 0025276, Kernel Git Commit 0443e44, Kernel Git Commit 1226293, Kernel Git Commit 347b59e, Kernel Git Commit 3750f75, Kernel Git Commit 9858c91, Kernel Git Commit c5371e0, and Kernel Git Commit d0ebf9c. The patch removes the unused vrequest->udc field and resolves the controller through ep_to_vudc() in vep_dequeue().

Workarounds

Blacklist the usbip_vudc module on systems that do not require USB/IP virtual device functionality.
Avoid binding FunctionFS gadgets to the usbip virtual UDC until the patched kernel is deployed.
Limit which users and containers can reach FunctionFS mount points to reduce the attack surface for AIO cancellation abuse.

bash

# Prevent the vulnerable module from loading until the kernel is patched
echo 'blacklist usbip_vudc' | sudo tee /etc/modprobe.d/blacklist-usbip-vudc.conf
sudo rmmod usbip_vudc 2>/dev/null || true
sudo update-initramfs -u