CVE-2026-64349: usb: dwc3: fix dwc3_readl() and dwc3_writel() calls in dwc3_ulpi_setup()
In the Linux kernel, the following vulnerability has been resolved:
usb: dwc3: fix dwc3readl() and dwc3writel() calls in dwc3ulpisetup()
The dwc3ulpisetup() calls the register read and write calls with dwc3->regs when both these calls take the dwc3 structure directly.
Chnage these two calls to fix the following sparse warning, and possibly a nasty bug in the dwc3ulpisetup() code:
drivers/usb/dwc3/core.c:796:45: warning: incorrect type in argument 1 (different address spaces) drivers/usb/dwc3/core.c:796:45: expected struct dwc3 dwc drivers/usb/dwc3/core.c:796:45: got void [noderef] iomem regs drivers/usb/dwc3/core.c:798:40: warning: incorrect type in argument 1 (different address spaces) drivers/usb/dwc3/core.c:798:40: expected struct dwc3 dwc drivers/usb/dwc3/core.c:798:40: got void [noderef] iomem regs
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-aws-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1014.14~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-fde-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1016.16~24.04.1 - Upgrade
Upgrade
ubuntu/linux-gcp-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1014.14~24.04.1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-38.38~24.04.4 - Upgrade
Upgrade
ubuntu/linux-nvidia-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1024.25~24.04.1 - Upgrade
Upgrade
ubuntu/linux-oracle-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1013.13~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-38.38 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1014.14 - Upgrade
Upgrade
ubuntu/linux-azureto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-azure-fdeto a version that resolves this vulnerability.Fixed in 7.0.0-1016.16 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1014.14 - Upgrade
Upgrade
ubuntu/linux-gketo a version that resolves this vulnerability.Fixed in 7.0.0-1008.9 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1015.15 - Upgrade
Upgrade
ubuntu/linux-nvidia-bosto a version that resolves this vulnerability.Fixed in 7.0.0-2022.23 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1015.15 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1013.13 - Upgrade
Upgrade
ubuntu/linux-realtimeto a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1 - Configuration
Change both register read and write calls in dwc3_ulpi_setup() to pass the dwc3 structure directly, as required by dwc3_readl() and dwc3_writel().
Linux kernel USB DWC3 dwc3_readl() and dwc3_writel() calls in dwc3_ulpi_setup() = Pass the dwc3 structure directly instead of dwc3->regs
Event History
Frequently Asked Questions
Which systems are most likely to be exposed?
Systems running a Linux kernel with the DWC3 USB driver and using the ULPI setup path are the relevant population. The listed affected software includes the Linux kernel and Ubuntu kernel variants for RISC-V, real-time, HWE edge, Azure, GCP, Azure FDE, and GKE.
What level of access does an attacker need?
The vector is local and requires low privileges. No user interaction is required, and the stated impact is denial of service rather than confidentiality or integrity loss.
What is the likely impact if the issue is exploited?
The CVSS data indicates high availability impact, with no stated confidentiality or integrity impact. The flaw may trigger a bug in DWC3 ULPI setup because register access helpers are called with the register pointer instead of the DWC3 structure.