CVE-2026-64464 Overview
CVE-2026-64464 is a memory leak vulnerability in the Linux kernel's xHCI (Extensible Host Controller Interface) sideband driver. The flaw resides in the xhci_ring_to_sgtable() function, which allocates a temporary pages array to build a scatter-gather table via sg_alloc_table_from_pages(). The success path returns the resulting sg_table without freeing the temporary pages array, leaking memory on every call. The leak occurs each time a sideband client requests an endpoint or event ring buffer, gradually consuming kernel memory over time.
Critical Impact
Repeated allocation of USB xHCI sideband ring buffers leaks kernel memory, degrading system stability and enabling resource exhaustion in long-running systems that use sideband USB device virtualization.
Affected Products
- Linux kernel versions containing the xhci sideband driver with xhci_ring_to_sgtable()
- Stable kernel branches receiving the backport commits 49f6e3c3ef19, 99d00a9e35e3, and a3eaf82ff842
- Systems using USB xHCI sideband client interfaces
Discovery Timeline
- 2026-07-25 - CVE-2026-64464 published to NVD
- 2026-07-25 - Last updated in NVD database
Technical Details for CVE-2026-64464
Vulnerability Analysis
The vulnerability is a memory leak [CWE-401] in the xHCI sideband subsystem of the Linux kernel. The xhci_ring_to_sgtable() helper constructs a scatter-gather table representing an xHCI ring buffer for a sideband client. Internally, it allocates a temporary array of struct page * pointers and passes it to sg_alloc_table_from_pages(). This helper copies the necessary page references into freshly allocated scatterlist entries within the returned sg_table.
The error handling paths correctly release the temporary pages array on failure. The success path, however, returns the sg_table directly to the caller and never frees the array. Because the returned sg_table owns its scatterlist entries independently of the temporary buffer, the array becomes unreachable and leaks. Each request from a sideband client for an endpoint or event ring buffer leaks another allocation.
Root Cause
The root cause is an omitted kvfree() or equivalent deallocation on the success return path of xhci_ring_to_sgtable(). The developer assumed cleanup responsibility transferred with the returned structure, but sg_alloc_table_from_pages() does not consume or take ownership of the caller-provided pages array. The fix frees the pages array immediately after sg_alloc_table_from_pages() succeeds, ensuring symmetric cleanup between success and failure paths.
Attack Vector
Exploitation requires local access to trigger repeated allocation of sideband endpoint or event ring buffers through the xHCI sideband client interface. A local user or malicious kernel module invoking sideband ring allocation in a loop can gradually exhaust kernel memory. The vulnerability is not remotely exploitable and does not directly enable code execution or privilege escalation. The primary impact is denial of service through kernel memory exhaustion on systems that rely on USB sideband virtualization.
See the upstream patches for technical details: kernel commit 49f6e3c3ef19, kernel commit 99d00a9e35e3, and kernel commit a3eaf82ff842.
Detection Methods for CVE-2026-64464
Indicators of Compromise
- Gradual increase in kernel slab memory usage over time on systems using xHCI sideband clients, visible via /proc/slabinfo or slabtop.
- Rising kmalloc allocations without corresponding reclamation on hosts performing frequent USB sideband endpoint or event ring buffer setup.
- Out-of-memory conditions or kernel allocation failures after prolonged uptime on systems using USB device virtualization with sideband.
Detection Strategies
- Audit installed kernel versions against the fixed stable branches referenced in the upstream commits to identify vulnerable hosts.
- Monitor kernel memory growth trends using meminfo, slabtop, and kernel tracing tools such as kmemleak to identify unreclaimed allocations from xhci_ring_to_sgtable().
- Correlate memory growth with sideband client activity by enabling xHCI dynamic debug logging.
Monitoring Recommendations
- Collect and centralize kernel memory metrics and OOM (out-of-memory) events from Linux endpoints and servers using USB virtualization.
- Establish baselines for kernel slab consumption and alert on sustained growth on hosts with active xHCI sideband workloads.
- Track kernel package versions across the fleet and flag systems still running pre-patch kernels for prioritized remediation.
How to Mitigate CVE-2026-64464
Immediate Actions Required
- Update affected Linux systems to a kernel version that includes commits 49f6e3c3ef19, 99d00a9e35e3, or a3eaf82ff842 from the stable tree.
- Reboot updated systems to load the patched kernel and clear any leaked memory accumulated by the vulnerable version.
- Restrict local access on systems where the kernel cannot be immediately updated, as exploitation requires local invocation of sideband ring allocation.
Patch Information
The fix adds a call to free the temporary pages array after sg_alloc_table_from_pages() returns successfully in xhci_ring_to_sgtable(). Apply the upstream fix by updating to a kernel that incorporates the referenced stable commits. Distribution vendors including Red Hat, SUSE, Debian, Ubuntu, and Oracle typically publish backported kernel packages. Monitor your distribution's security advisory feed for the corresponding update.
Workarounds
- If patching is not immediately possible, avoid loading or exercising xHCI sideband client drivers on affected kernels to prevent the leak from accumulating.
- Schedule periodic reboots on long-running systems that must use sideband functionality to reclaim leaked kernel memory until a patched kernel is deployed.
- Limit which users and processes can trigger sideband ring buffer allocation through kernel module access controls and standard Linux capability restrictions.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
