CVE-2026-64464: xhci: sideband: fix ring sg table pages leak
In the Linux kernel, the following vulnerability has been resolved:
xhci: sideband: fix ring sg table pages leak
xhciringtosgtable() allocates a temporary pages array and uses it to build the returned sgtable with sgalloctablefrompages().
The error paths free the pages array, but the success path returns the sgtable without freeing it. This leaks the temporary array every time a sideband client gets an endpoint or event ring buffer.
Free the pages array after sgalloctablefrompages() succeeds. The returned sgtable has its own scatterlist entries and does not depend on the temporary array after construction.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-64464?
The severity of CVE-2026-64464 is rated at 9, indicating a critical risk level.
How do I fix CVE-2026-64464?
To fix CVE-2026-64464, ensure that your Linux kernel is updated to the latest version where the vulnerability has been patched.
What are the potential impacts of CVE-2026-64464?
CVE-2026-64464 can lead to a memory leak, allowing for performance degradation or other system malfunctions.
Is CVE-2026-64464 related to data security?
Yes, CVE-2026-64464 can potentially affect data security by causing instability or unexpected behavior in systems running the vulnerable Linux kernel.
When was CVE-2026-64464 published?
CVE-2026-64464 was published on July 25, 2026.