CVE-2026-64348 Overview
CVE-2026-64348 is a memory leak vulnerability in the Linux kernel's USB subsystem. The flaw affects the Enhanced Host Controller Interface (EHCI) and FOTG210 isochronous USB submit paths. When a Universal Serial Bus Request Block (URB) submission fails before the URB is linked to the endpoint queue, the staged ehci_iso_sched structure attached to urb->hcpriv is not freed. This results in a kernel memory leak on every failed isochronous submission attempt against an inaccessible controller or a failing usb_hcd_link_urb_to_ep() call.
Critical Impact
Repeated failed isochronous USB submissions leak kernel memory, degrading system stability over time on affected hosts.
Affected Products
- Linux kernel EHCI USB host controller driver
- Linux kernel FOTG210 USB host controller driver
- Linux kernel versions confirmed affected in v6.13-rc1 through v7.1.1
Discovery Timeline
- 2026-07-25 - CVE-2026-64348 published to the National Vulnerability Database
- 2026-07-25 - Last updated in NVD database
Technical Details for CVE-2026-64348
Vulnerability Analysis
The EHCI and FOTG210 drivers construct an ehci_iso_sched structure during isochronous URB submission. This staged schedule is stored in urb->hcpriv before the URB is linked to the endpoint queue. Ownership of the schedule normally transfers to iso_stream_schedule() and the link helper functions once the URB is successfully linked.
When the host controller is no longer accessible or usb_hcd_link_urb_to_ep() returns an error, submission jumps to the done_not_linked label. This early exit path bypasses the handoff logic that would consume the staged schedule. The allocated ehci_iso_sched remains referenced by urb->hcpriv but is never freed, producing a memory leak on each failed submit.
Root Cause
The root cause is missing cleanup of driver-private state on an error path. The done_not_linked label was not updated to free the staged isochronous schedule or to clear urb->hcpriv when submission fails before the link operation completes.
Attack Vector
The issue triggers whenever an isochronous URB submission fails prior to linking. Scenarios include a disconnected or resetting EHCI/FOTG210 host controller and endpoint queue link failures. Each failed submission leaks the memory allocated for the schedule until the module is unloaded or the system reboots.
The patch frees the staged schedule from the done_not_linked exit path and clears urb->hcpriv after the free. See the upstream kernel commit b9399d2 for the reference implementation.
Detection Methods for CVE-2026-64348
Indicators of Compromise
- Gradual growth in kernel kmalloc slab consumption on systems using EHCI or FOTG210 host controllers
- Repeated dmesg entries reporting failed USB isochronous submissions or usb_hcd_link_urb_to_ep() errors
- Unexplained kernel memory pressure on hosts with unstable or frequently disconnected USB isochronous devices
Detection Strategies
- Monitor /proc/slabinfo for growth in USB-related slab caches over time
- Compare running kernel versions against the fixed commits listed in the upstream references to identify unpatched systems
- Correlate USB controller disconnect events with subsequent memory growth using kernel tracing tools such as ftrace or bpftrace
Monitoring Recommendations
- Track kernel memory usage baselines on servers and appliances that expose EHCI or FOTG210 controllers
- Alert on repeated USB host controller error messages that can drive the leak
- Include kernel package inventory in configuration management to flag hosts running vulnerable kernel builds
How to Mitigate CVE-2026-64348
Immediate Actions Required
- Apply the latest stable Linux kernel update from your distribution vendor that includes the fix for CVE-2026-64348
- Identify systems running EHCI or FOTG210 USB host controllers and prioritize patching those hosts
- Where patching is not immediately possible, reboot affected systems periodically to reclaim leaked kernel memory
Patch Information
The fix has been merged across multiple stable kernel branches. Refer to the upstream commits for backport details: Kernel Git Commit 4bb88ae, Kernel Git Commit 6bc17a7, Kernel Git Commit 8890699, Kernel Git Commit b0d00d0, Kernel Git Commit b9399d2, and Kernel Git Commit be50043.
Workarounds
- Disconnect or remove USB isochronous devices such as audio and video peripherals from affected EHCI/FOTG210 hosts if patching must be delayed
- Unload the ehci_hcd or fotg210_hcd module on systems that do not require USB isochronous transfers
- Schedule maintenance reboots to reclaim leaked memory on long-running hosts until the patched kernel is deployed
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
