CVE-2026-64350 Overview
CVE-2026-64350 is a memory leak vulnerability in the Linux kernel's Cadence USBSSP (cdnsp) USB device controller driver. The flaw resides in the cdnsp_alloc_stream_info() function, where the stream context array allocated by cdnsp_alloc_stream_ctx() is not freed when subsequent allocation or mapping operations fail. Repeated failures along this error path exhaust kernel memory over time. The issue affects kernel builds that include the cdnsp driver and has been resolved across multiple stable branches through upstream patches.
Critical Impact
Repeated stream allocation failures leak the stream_ctx_array DMA buffer on each error path, gradually depleting kernel memory and degrading system stability on hosts using Cadence USBSSP hardware.
Affected Products
- Linux kernel builds containing the drivers/usb/cdns3/cdnsp-mem.ccdnsp driver
- Systems using Cadence USBSSP USB 3.x device controllers
- Multiple stable kernel branches referenced by the upstream fix commits
Discovery Timeline
- 2026-07-25 - CVE-2026-64350 published to NVD
- 2026-07-25 - Last updated in NVD database
Technical Details for CVE-2026-64350
Vulnerability Analysis
The defect is a memory leak [CWE-401] in the Cadence USBSSP peripheral controller driver. cdnsp_alloc_stream_info() allocates a stream context array by calling cdnsp_alloc_stream_ctx() early in its setup routine. The function then proceeds to allocate individual stream rings and update stream mapping structures.
When a later stream ring allocation or a stream mapping update fails, control jumps to the shared cleanup label. That cleanup path frees the allocated stream rings and the stream_rings array but never releases stream_ctx_array. Each failed invocation therefore leaks the DMA-coherent buffer backing the stream context array.
An attacker with the ability to trigger repeated stream endpoint setup failures against an affected device can exhaust kernel memory. The condition is a resource management error, not a memory corruption primitive, so direct code execution is not expected. The realistic outcome is degraded availability on systems using the cdnsp driver.
Root Cause
The error path in cdnsp_alloc_stream_info() omits a cdnsp_free_stream_ctx() call before falling through to the stream_rings cleanup label. The upstream fix adds the missing free so that stream_ctx_array is released on every failure path.
Attack Vector
Triggering the leak requires interaction with the USB device controller stack in a way that causes stream ring allocation or stream mapping updates to fail after the context array is allocated. This generally requires local access or a controllable USB peripheral scenario on hosts running the cdnsp driver. No public exploit is available and the vulnerability is not listed in CISA KEV.
The vulnerability is a kernel-side resource leak; there is no exploitation code to publish. See the upstream commits referenced under Patch Information for the exact code change.
Detection Methods for CVE-2026-64350
Indicators of Compromise
- Progressive growth of kernel slab and DMA-coherent memory usage on hosts using Cadence USBSSP hardware without a corresponding workload change
- Repeated cdnsp driver error messages in dmesg referencing stream allocation or mapping failures
- Out-of-memory events on systems where the cdnsp driver is loaded and USB stream endpoints are repeatedly reconfigured
Detection Strategies
- Compare running kernel versions against the fixed commits (3348f444, 37283f5a, 963075c4, c00826e8, cb8e9391, d9643bbe, fde3c095) using configuration management inventory
- Monitor /proc/meminfo and /sys/kernel/debug/dma_pools trends for unexplained growth on affected hosts
- Alert on repeated cdnsp_alloc_stream_info related failures in kernel logs
Monitoring Recommendations
- Ingest kernel logs into a centralized logging platform and correlate USB subsystem errors with memory pressure metrics
- Track long-running hosts with the cdnsp driver loaded for gradual memory footprint increases
- Establish baselines for USB stream endpoint activity and alert on abnormal reallocation loops
How to Mitigate CVE-2026-64350
Immediate Actions Required
- Apply the upstream Linux kernel patches referenced in the git.kernel.org commits to all affected stable branches
- Prioritize patching hosts that expose Cadence USBSSP controllers to untrusted peripherals or multi-tenant workloads
- Reboot patched systems to ensure the fixed cdnsp driver is loaded
Patch Information
The fix adds the missing cdnsp_free_stream_ctx() call so stream_ctx_array is released before the shared cleanup path runs. The change is available in the following upstream commits: Kernel Git Commit 3348f444, Kernel Git Commit 37283f5a, Kernel Git Commit 963075c4, Kernel Git Commit c00826e8, Kernel Git Commit cb8e9391, Kernel Git Commit d9643bbe, and Kernel Git Commit fde3c095.
Workarounds
- Unload the cdnsp module on systems that do not require Cadence USBSSP functionality until patches are applied
- Restrict physical and logical access to USB device controller ports on affected hosts
- Schedule periodic reboots of long-running affected hosts to reclaim leaked memory as a temporary measure
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
