CVE-2026-64331

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A NULL pointer dereference exists in the vep dequeue() function within the usbip vudc component. The issue occurs because vep alloc request() fails to initialize the vrequest->udc variable. Consequently, cancellations on the FunctionFS AIO path reach vep dequeue() without a valid UDC reference, which can lead to a system oops.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.