CVE-2026-64337: usb: mtu3: unmap request DMA on queue failure
In the Linux kernel, the following vulnerability has been resolved:
usb: mtu3: unmap request DMA on queue failure
mtu3gadgetqueue() maps the request before checking whether the QMU GPD ring can accept another transfer. the request is returned with -EAGAIN before it is linked on the endpoint request list if mtu3preparetransfer() fails.
Normal completion and dequeue paths unmap requests from mtu3reqcomplete(), but this error path never reaches that helper, so the DMA mapping is left active. Unmap the request before returning from the failed queue path.
Affected Software
Remediation
Event History
Frequently Asked Questions
What access does an attacker need to trigger this issue?
The CVSS vector indicates local access and low privileges are required. No user interaction is required.
What is the impact if the issue is exploited?
The reported impact is availability only, rated high in the CVSS vector. Confidentiality and integrity impacts are listed as none.
Under what condition does the DMA mapping remain active?
It occurs when mtu3_gadget_queue() has mapped a request but mtu3_prepare_transfer() cannot accept another transfer in the QMU GPD ring and returns -EAGAIN. The request is not added to the endpoint request list, so the normal completion and dequeue paths do not unmap it.
What remediation is available?
A patch is available that unmaps the request before returning from the failed queue path.