CVE-2026-64349 Overview
CVE-2026-64349 is a Linux kernel vulnerability in the DesignWare USB 3.0 (DWC3) controller driver. The flaw resides in the dwc3_ulpi_setup() function in drivers/usb/dwc3/core.c, where the register accessor functions dwc3_readl() and dwc3_writel() are invoked with the wrong argument type. The code passes dwc3->regs (an __iomem pointer) when the accessors expect a pointer to the dwc3 structure directly. This address-space mismatch was surfaced as a sparse static analysis warning and represents a latent defect in the ULPI (UTMI+ Low Pin Interface) setup path for USB PHY initialization.
Critical Impact
Incorrect register accessor usage in the DWC3 driver's ULPI setup path can produce undefined behavior during USB PHY initialization on affected systems.
Affected Products
- Linux kernel (upstream) — DWC3 USB controller driver (drivers/usb/dwc3/core.c)
- Distributions shipping vulnerable kernels prior to the fix commits
- Systems using the DesignWare USB 3.0 controller with a ULPI-attached PHY
Discovery Timeline
- 2026-07-25 - CVE-2026-64349 published to NVD
- 2026-07-25 - Last updated in NVD database
Technical Details for CVE-2026-64349
Vulnerability Analysis
The dwc3_ulpi_setup() function is responsible for initializing the ULPI interface used to communicate with an external USB PHY on DWC3-based controllers. The function must read and write DWC3 controller registers to configure ULPI mode. The Linux kernel exposes two accessor helpers, dwc3_readl() and dwc3_writel(), that operate on the driver's struct dwc3 * context.
In the vulnerable code path, dwc3_ulpi_setup() calls these accessors with dwc3->regs — the raw __iomem base pointer — instead of the expected dwc3 structure pointer. Sparse static analysis flagged the type mismatch at drivers/usb/dwc3/core.c:796 and drivers/usb/dwc3/core.c:798 with warnings about incorrect address spaces.
While the immediate symptom is a compiler-level warning, the mismatch can result in the accessors dereferencing the wrong offset or object layout during PHY setup, producing incorrect register operations at initialization.
Root Cause
The root cause is an API misuse defect. The dwc3_readl() and dwc3_writel() wrappers take a struct dwc3 *dwc argument and internally compute the correct MMIO address from dwc->regs. Passing dwc3->regs directly bypasses that indirection and supplies an __iomem pointer where a kernel structure pointer is expected. This is a type confusion at the address-space level rather than a memory-safety corruption in the traditional heap sense.
Attack Vector
The defect is confined to the kernel USB host controller initialization path. It is triggered during driver probe and ULPI PHY setup, not through user-controllable input over USB. There is no known remote or unprivileged local exploitation path documented in the referenced kernel commits. The fix is a correctness change addressing a latent bug and a static analysis warning. Refer to the upstream commits for the exact code diff: Kernel Git Commit 41a4e80, Kernel Git Commit 4349e48, and Kernel Git Commit e0f844d.
Detection Methods for CVE-2026-64349
Indicators of Compromise
- No runtime indicators of compromise are associated with this defect. It manifests as a build-time sparse warning and potential DWC3 controller misbehavior during driver initialization.
- Kernel log messages related to DWC3 probe failures or ULPI PHY initialization errors on affected hardware may indicate the latent bug is being hit.
Detection Strategies
- Enumerate running kernel versions across the fleet and compare against the fix commits 41a4e80, 4349e48, and e0f844d to identify unpatched systems.
- Rebuild affected kernels with make C=1 to reproduce the sparse warnings in drivers/usb/dwc3/core.c around lines 796 and 798.
- Review vendor kernel changelogs for backports referencing dwc3_ulpi_setup() and the DWC3 register accessor fix.
Monitoring Recommendations
- Monitor dmesg output on systems with DWC3 controllers for anomalous USB PHY or ULPI initialization messages.
- Track distribution security advisories and stable kernel releases for inclusion of the referenced commit hashes.
- Include kernel package versions in configuration management inventories to accelerate patch verification.
How to Mitigate CVE-2026-64349
Immediate Actions Required
- Apply the upstream Linux kernel patches referenced in the CVE record on any system running an affected DWC3 driver.
- Prioritize embedded and ARM-based platforms that rely on the DWC3 controller with a ULPI-attached PHY, as these are most likely to execute the affected code path.
- Track your Linux distribution vendor's advisories for backported fixes and update kernel packages when available.
Patch Information
The fix changes the arguments passed to dwc3_readl() and dwc3_writel() in dwc3_ulpi_setup() from dwc3->regs to the dwc3 structure pointer, matching the accessor prototypes. The correction is delivered in three stable-tree commits: Kernel Git Commit 41a4e80, Kernel Git Commit 4349e48, and Kernel Git Commit e0f844d. Rebuild and redeploy affected kernels once the patch is merged into your kernel source tree.
Workarounds
- No supported workaround exists at runtime. The defect must be corrected in the kernel source and the kernel rebuilt or updated from a patched package.
- On systems that do not require USB via the DWC3 controller, disabling the CONFIG_USB_DWC3 module and blacklisting dwc3 avoids executing the affected code path.
- Where feasible, use a downstream kernel release that already includes the referenced commits until your distribution ships an updated package.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
