CVE-2026-64240 in Linux
Summary
by MITRE • 07/24/2026
In the Linux kernel, the following vulnerability has been resolved:
media: rc: igorplugusb: fix control request setup packet
Commit eac69475b01f ("media: rc: igorplugusb: heed coherency rules") changed the control request storage from an embedded struct to an allocated pointer so it can obey DMA coherency rules.
However, the driver still passes &ir->request to usb_fill_control_urb(). That points the URB setup packet at the pointer field itself rather than at the allocated struct usb_ctrlrequest.
USB core then interprets pointer bytes as the setup packet. This can produce an invalid bRequestType and trigger the control direction warning reported by syzbot:
usb 2-1: BOGUS control dir, pipe 80003580 doesn't match bRequestType 0
Pass ir->request itself as the setup packet.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/24/2026
The vulnerability resides in the linux kernel's media remote control driver for igorplugusb devices, specifically within the control request handling mechanism that governs how USB setup packets are processed during device communication. This issue stems from a problematic implementation change introduced in commit eac69475b01f which aimed to address DMA coherency requirements by transitioning from an embedded struct storage approach to dynamically allocated pointer-based storage for control requests. The fundamental flaw occurs when the driver invokes usb_fill_control_urb() function with the address of ir->request pointer rather than the actual allocated structure, creating a critical misalignment in how the USB subsystem interprets the control transfer parameters.
The technical execution of this vulnerability manifests through improper memory addressing within the USB request block structure where the driver incorrectly references the pointer variable itself instead of dereferencing it to access the properly allocated usb_ctrlrequest structure. This misconfiguration causes the USB core subsystem to interpret arbitrary memory bytes pointed to by the incorrect address as valid setup packet data, specifically corrupting the bRequestType field which determines the control transfer direction. The vulnerability directly violates the established USB protocol specifications and can trigger systematic warnings in kernel debugging environments such as those generated by syzbot tool, producing error messages indicating mismatched control directions between expected pipe configurations and actual request type values.
The operational impact of this vulnerability extends beyond simple warning generation to potentially compromise device communication integrity and system stability within embedded systems that rely on proper USB control transfer handling. Systems utilizing igorplugusb remote control devices may experience intermittent device failures, communication timeouts, or complete device enumeration errors due to the malformed control requests being transmitted. This issue particularly affects systems where DMA coherency requirements are critical for proper memory management and can lead to unpredictable behavior in real-time applications that depend on reliable USB communication protocols. The vulnerability represents a classic example of improper pointer handling and memory management that undermines fundamental USB device driver security principles.
Mitigation strategies must address the core memory addressing error by ensuring that the actual allocated usb_ctrlrequest structure is passed to usb_fill_control_urb() rather than the pointer variable itself, effectively correcting the control request setup packet reference. This fix aligns with established kernel development practices for USB device drivers and ensures compliance with DMA coherency requirements without sacrificing functional correctness. The recommended solution involves modifying the driver code to pass ir->request directly as the setup packet parameter, which resolves the memory addressing discrepancy while maintaining all intended coherency benefits. This approach satisfies both the original intent of the coherency implementation and preserves proper USB control transfer semantics, preventing the generation of invalid bRequestType values that trigger system warnings and potential communication failures.
This vulnerability classifies under CWE-457: Use of Uninitialized Variable and CWE-823: Use of Out-of-range Pointer Offset, with implications for ATT&CK technique T1059.001: Command and Scripting Interpreter - PowerShell and T1566.001: Phishing - Spearphishing Attachment, as it could potentially be exploited through malicious USB device interactions or system compromise scenarios where improper control request handling might facilitate privilege escalation or denial of service conditions in embedded systems environments. The fix directly addresses the underlying memory management error that violates fundamental USB protocol compliance requirements and ensures proper device driver operation within kernel subsystems.