CVE-2026-64240: media: rc: igorplugusb: fix control request setup packet
In the Linux kernel, the following vulnerability has been resolved:
media: rc: igorplugusb: fix control request setup packet
Commit eac69475b01f ("media: rc: igorplugusb: heed coherency rules") changed the control request storage from an embedded struct to an allocated pointer so it can obey DMA coherency rules.
However, the driver still passes &ir->request to usbfillcontrolurb(). That points the URB setup packet at the pointer field itself rather than at the allocated struct usbctrlrequest.
USB core then interprets pointer bytes as the setup packet. This can produce an invalid bRequestType and trigger the control direction warning reported by syzbot:
usb 2-1: BOGUS control dir, pipe 80003580 doesn't match bRequestType 0
Pass ir->request itself as the setup packet.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Linux kernel (media: rc: igorplugusb: fix control request setup packet)to a version that resolves this vulnerability.Patch eac69475b01f - Compensating control
Ensure the USB control URB setup packet is built from the correct allocated usb_ctrlrequest storage (pass the ir->request itself as the setup packet to avoid USB core interpreting pointer bytes as the setup packet and triggering invalid bRequestType/control direction warnings).
Event History
Frequently Asked Questions
What level of access does an attacker need?
Exploitation requires local access with low privileges; no user interaction is required. The CVSS vector indicates the issue affects availability, with no stated confidentiality or integrity impact.
What component and condition are involved?
The affected condition is in the Linux kernel igorplugusb remote-control driver when it prepares a USB control URB. The driver passes the address of its request pointer rather than the allocated USB control-request structure, causing USB core to interpret pointer bytes as the setup packet.
Is a fix available, and is there a documented workaround?
The provided stable-kernel references identify fixes for this issue. If updating is not immediately possible, the provided information does not specify a workaround or configuration mitigation.