CVE-2026-64350: usb: cdnsp: fix stream context array leak in cdnsp_alloc_stream_info()
In the Linux kernel, the following vulnerability has been resolved:
usb: cdnsp: fix stream context array leak in cdnspallocstreaminfo()
cdnspallocstreaminfo() allocates streaminfo->streamctxarray with cdnspallocstreamctx(). If a later stream ring allocation or stream mapping update fails, the error path frees the allocated stream rings and streamrings array, but leaves streamctxarray allocated.
Free the stream context array before falling through to the streamrings cleanup path.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.145.2-1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-64350?
The severity of CVE-2026-64350 is rated as medium with a score of 5.5.
What does CVE-2026-64350 affect?
CVE-2026-64350 affects the Linux kernel, specifically related to USB stream context allocation.
How do I fix CVE-2026-64350?
To fix CVE-2026-64350, update to the latest version of the Linux kernel where the vulnerability has been patched.
What is the risk associated with CVE-2026-64350?
The risk associated with CVE-2026-64350 is considered low due to the requirement for local access to exploit.
What systems are impacted by CVE-2026-64350?
CVE-2026-64350 impacts systems running the affected versions of the Linux kernel and Microsoft azl3 kernel.