https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 23:09:35 +0000 https://vulnerability.circl.lu/vuln/cve-2026-64240 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>media: rc: igorplugusb: fix control request setup packet</p> <p>Commit eac69475b01f (&#34;media: rc: igorplugusb: heed coherency rules&#34;) changed the control request storage from an embedded struct to an allocated pointer so it can obey DMA coherency rules.</p> <p>However, the driver still passes &amp;ir-&gt;request to usb_fill_control_urb(). That points the URB setup packet at the pointer field itself rather than at the allocated struct usb_ctrlrequest.</p> <p>USB core then interprets pointer bytes as the setup packet. This can produce an invalid bRequestType and trigger the control direction warning reported by syzbot:</p> <p>usb 2-1: BOGUS control dir, pipe 80003580 doesn&#39;t match bRequestType 0</p> <p>Pass ir-&gt;request itself as the setup packet.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>media: rc: igorplugusb: fix control request setup packet</p> <p>Commit eac69475b01f (&#34;media: rc: igorplugusb: heed coherency rules&#34;) changed the control request storage from an embedded struct to an allocated pointer so it can obey DMA coherency rules.</p> <p>However, the driver still passes &amp;ir-&gt;request to usb_fill_control_urb(). That points the URB setup packet at the pointer field itself rather than at the allocated struct usb_ctrlrequest.</p> <p>USB core then interprets pointer bytes as the setup packet. This can produce an invalid bRequestType and trigger the control direction warning reported by syzbot:</p> <p>usb 2-1: BOGUS control dir, pipe 80003580 doesn&#39;t match bRequestType 0</p> <p>Pass ir-&gt;request itself as the setup packet.</p> https://vulnerability.circl.lu/vuln/cve-2026-64240