CVE-2026-64337

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the usb mtu3 component where the mtu3 gadget queue() function maps a request before verifying if the QMU GPD ring can accept another transfer. If the mtu3 prepare transfer() function fails, the request is returned with an -EAGAIN error before being linked to the endpoint request list. Because this specific error path does not reach the mtu3 req complete() helper function used by normal completion and dequeue paths, the DMA (Direct Memory Access) mapping remains active.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.