CVE-2026-64331 in Linux
Summary
by MITRE • 07/25/2026
In the Linux kernel, the following vulnerability has been resolved:
usbip: vudc: fix NULL deref in vep_dequeue()
vep_alloc_request() wasn't initializing vrequest->udc, so cancellations on the FunctionFS AIO path were arriving in vep_dequeue without a valid UDC reference.
Since vrequest->udc is never actually properly used anywhere, we opt to remove it, and update vep_dequeue to obtain a reference to the udc with ep_to_vudc(), consistent with the other vep_ ops.
AFAICT this bug has existed for ~10 years. Seems that nobody has really stressed the FunctionFS AIO path on usbip's vudc.
I tested this fix in a QEMU aarch64 guest driving FunctionFS endpoints via AIO. Before the fix, running `usbip attach` from the host would cause the guest to oops with the following backtrace:
Call trace: vep_dequeue+0x1c/0xe4 (P) usb_ep_dequeue+0x14/0x20 ffs_aio_cancel+0x24/0x34 __arm64_sys_io_cancel+0xb0/0x124 do_el0_svc+0x68/0x100 el0_svc+0x18/0x5c el0t_64_sync_handler+0x98/0xdc el0t_64_sync+0x154/0x158
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/25/2026
The vulnerability resides within the Linux kernel's usbip virtual USB device controller implementation specifically affecting the FunctionFS AIO path through the vudc subsystem. This represents a classic null pointer dereference issue that has persisted for approximately ten years due to inadequate initialization of critical data structures. The flaw manifests when asynchronous I/O operations are canceled on FunctionFS endpoints, causing kernel oops conditions and system instability.
The technical root cause stems from improper initialization within the vep_alloc_request() function where the vrequest->udc field remains uninitialized. This parameter is subsequently referenced in the vep_dequeue() function during cancellation operations, creating a scenario where a null pointer dereference occurs when attempting to access the UDC reference. The vulnerability affects the USB/IP virtual device controller implementation that handles FunctionFS endpoint operations through asynchronous I/O mechanisms.
The operational impact of this vulnerability extends beyond simple system crashes to potentially enabling denial-of-service conditions within kernel space. When userspace applications attempt to cancel asynchronous I/O operations on FunctionFS endpoints via usbip's vudc interface, the kernel experiences a null pointer dereference that results in immediate system oops and potential system hang conditions. The fix addresses this by removing the unused udc reference field entirely and implementing proper UDC acquisition through ep_to_vudc() function calls consistent with other vep_ operations, following established patterns within the subsystem.
This vulnerability aligns with CWE-476 which describes null pointer dereference conditions in kernel space operations. The attack surface is limited to systems utilizing usbip virtual USB device controllers with FunctionFS endpoints and asynchronous I/O operations, though the persistence of this flaw suggests it may be exploited in embedded systems or virtualized environments where such functionality is heavily utilized. The fix demonstrates proper defensive programming practices by removing unused fields and ensuring consistent reference acquisition patterns throughout the subsystem.
The mitigation strategy involves applying the kernel patch that removes the uninitialized udc field and updates the vep_dequeue function to properly acquire UDC references through established interfaces rather than relying on potentially uninitialized pointers. This approach follows ATT&CK technique T1068 which involves privilege escalation through kernel vulnerabilities, though in this case the impact is more focused on system stability rather than unauthorized privilege elevation. Testing confirmed that the fix resolves the oops condition in QEMU aarch64 environments where FunctionFS endpoints are driven via AIO operations, preventing the call trace from occurring during usbip attach operations from host systems.