CVE-2026-64337 Overview
CVE-2026-64337 is a Linux kernel vulnerability in the MediaTek USB3 (mtu3) gadget driver. The mtu3_gadget_queue() function maps a request for Direct Memory Access (DMA) before validating that the Queue Management Unit (QMU) General Purpose Descriptor (GPD) ring can accept another transfer. When mtu3_prepare_transfer() fails, the request returns with -EAGAIN before being linked to the endpoint request list. The standard completion path in mtu3_req_complete() never executes, so the DMA mapping remains active and leaks.
Critical Impact
Repeated queue failures leak DMA mappings in the USB gadget subsystem, leading to resource exhaustion on affected MediaTek USB3 controllers.
Affected Products
- Linux kernel (upstream) with the usb: mtu3 MediaTek USB3 gadget driver
- Stable kernel branches referenced by commits 00c3fef, 0bddda5, 3cee30f, 4183874, 835b059, 8c29d9c, e8f739a, and f3c4026
- Distributions shipping vulnerable stable kernels prior to backport of the fix
Discovery Timeline
- 2026-07-25 - CVE-2026-64337 published to the National Vulnerability Database (NVD)
- 2026-07-25 - Last updated in NVD database
Technical Details for CVE-2026-64337
Vulnerability Analysis
The defect lives in drivers/usb/mtu3/mtu3_gadget.c. The queue function mtu3_gadget_queue() calls usb_gadget_map_request() to establish a DMA mapping for the incoming USB request. Only after mapping does it invoke mtu3_prepare_transfer() to check whether the QMU GPD ring has an available descriptor slot.
When the ring is full, mtu3_prepare_transfer() returns an error and the queue path returns -EAGAIN to the caller. The request never joins the endpoint's active list, so it will never be reclaimed by the normal completion flow. The unmap operation is confined to mtu3_req_complete(), which is unreachable in this error path.
The result is a persistent DMA mapping tied to an unowned request. Each failed queue attempt on a saturated GPD ring adds another leaked mapping. Over time this exhausts the IOMMU or swiotlb pool servicing the controller and degrades USB gadget functionality.
Root Cause
The root cause is a memory leak on an error path in kernel driver code. The DMA mapping is acquired before the operation that can fail, and no cleanup handler unmaps the request when mtu3_prepare_transfer() rejects the transfer. This is a classic acquire-before-validate ordering flaw combined with missing rollback on failure.
Attack Vector
The issue is triggered by USB gadget workloads that submit transfers faster than the QMU GPD ring can drain. A local process or attached USB host that induces repeated -EAGAIN conditions on the gadget endpoint can accumulate leaked DMA mappings. The vulnerability is not a remote network exploit and requires interaction with the USB gadget stack on affected MediaTek hardware.
The fix, applied across the referenced stable branches, calls usb_gadget_unmap_request() before returning from the failed queue path. Technical details appear in the upstream commits, including Kernel Git Commit 4183874 and Kernel Git Commit e8f739a.
Detection Methods for CVE-2026-64337
Indicators of Compromise
- Growing count of active DMA mappings attributed to the mtu3 driver in /sys/kernel/debug/dma-api or IOMMU debug interfaces.
- Kernel log entries showing repeated -EAGAIN returns from USB gadget queue operations on MediaTek USB3 endpoints.
- Progressive USB gadget throughput degradation on long-running systems using the mtu3 driver.
Detection Strategies
- Audit the running kernel version against the fixed commits listed in the upstream references and flag hosts still on vulnerable stable branches.
- Enable CONFIG_DMA_API_DEBUG on test kernels to surface unmapped-on-error conditions during USB gadget stress testing.
- Correlate USB subsystem error rates with DMA pool utilization to identify hosts trending toward exhaustion.
Monitoring Recommendations
- Track kernel package versions across fleet inventory and alert on hosts running unpatched MediaTek-based platforms.
- Monitor dmesg for repeated mtu3 queue failures and correlate with device-side USB errors.
- Baseline DMA pool consumption on embedded and mobile devices using the mtu3 driver and alert on sustained upward drift.
How to Mitigate CVE-2026-64337
Immediate Actions Required
- Identify systems running the mtu3 MediaTek USB3 gadget driver, typically embedded platforms and MediaTek-based mobile or IoT devices.
- Apply the upstream stable kernel update containing the unmap-on-failure fix from the referenced commits.
- Reboot affected devices after patching to clear any accumulated leaked DMA mappings.
Patch Information
The fix is available in multiple stable branches through the following upstream commits: Kernel Git Commit 00c3fef, Kernel Git Commit 0bddda5, Kernel Git Commit 3cee30f, Kernel Git Commit 4183874, Kernel Git Commit 835b059, Kernel Git Commit 8c29d9c, Kernel Git Commit e8f739a, and Kernel Git Commit f3c4026. Rebuild vendor kernels against the appropriate stable branch and redeploy.
Workarounds
- If patching is not immediately possible, unload the mtu3 module on systems that do not require USB gadget mode: modprobe -r mtu3.
- Restrict workloads that generate high-rate USB gadget transfers likely to saturate the QMU GPD ring.
- Schedule periodic reboots on affected devices to reclaim leaked DMA mappings until a patched kernel is deployed.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
