GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-64331 (GCVE-0-2026-64331)

Vulnerability from cvelistv5 – Published: 2026-07-25 08:49 – Updated: 2026-08-17 04:53
VLAI
Title
usbip: vudc: fix NULL deref in vep_dequeue()
Summary
In the Linux kernel, the following vulnerability has been resolved: usbip: vudc: fix NULL deref in vep_dequeue() vep_alloc_request() wasn't initializing vrequest->udc, so cancellations on the FunctionFS AIO path were arriving in vep_dequeue without a valid UDC reference. Since vrequest->udc is never actually properly used anywhere, we opt to remove it, and update vep_dequeue to obtain a reference to the udc with ep_to_vudc(), consistent with the other vep_ ops. AFAICT this bug has existed for ~10 years. Seems that nobody has really stressed the FunctionFS AIO path on usbip's vudc. I tested this fix in a QEMU aarch64 guest driving FunctionFS endpoints via AIO. Before the fix, running `usbip attach` from the host would cause the guest to oops with the following backtrace: Call trace: vep_dequeue+0x1c/0xe4 (P) usb_ep_dequeue+0x14/0x20 ffs_aio_cancel+0x24/0x34 __arm64_sys_io_cancel+0xb0/0x124 do_el0_svc+0x68/0x100 el0_svc+0x18/0x5c el0t_64_sync_handler+0x98/0xdc el0t_64_sync+0x154/0x158
Severity
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: b6a0ca11186759ad7045d68a5447b1e89f658384 , < 9858c91d9ee6a13c45311569039413729fc9b757 (git)
Affected: b6a0ca11186759ad7045d68a5447b1e89f658384 , < 1226293ec9bed3d4cc5b05eeeb811d315ca51652 (git)
Affected: b6a0ca11186759ad7045d68a5447b1e89f658384 , < 3750f75f29f99c0223601e2ee73ad084adec47bd (git)
Affected: b6a0ca11186759ad7045d68a5447b1e89f658384 , < d0ebf9cc7c2ddf95a7cfc654b940bdacb7edde97 (git)
Affected: b6a0ca11186759ad7045d68a5447b1e89f658384 , < 0025276175fbbe0dcbf3f84d090b0adee769e9d9 (git)
Affected: b6a0ca11186759ad7045d68a5447b1e89f658384 , < 347b59e9f96719d89b6ef555d02a18ada1a5846f (git)
Affected: b6a0ca11186759ad7045d68a5447b1e89f658384 , < 0443e4416aa1ee97748d1ed904eaf3352c60045e (git)
Affected: b6a0ca11186759ad7045d68a5447b1e89f658384 , < c5371e0b91b24159a3ebaa61e70b0980bcf03c0a (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.7
Unaffected: 0 , < 4.7 (semver)
Unaffected: 5.10.261 , ≤ 5.10.* (semver)
Unaffected: 5.15.212 , ≤ 5.15.* (semver)
Unaffected: 6.1.178 , ≤ 6.1.* (semver)
Unaffected: 6.6.145 , ≤ 6.6.* (semver)
Unaffected: 6.12.96 , ≤ 6.12.* (semver)
Unaffected: 6.18.39 , ≤ 6.18.* (semver)
Unaffected: 7.1.4 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/usbip/vudc.h",
            "drivers/usb/usbip/vudc_dev.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "9858c91d9ee6a13c45311569039413729fc9b757",
              "status": "affected",
              "version": "b6a0ca11186759ad7045d68a5447b1e89f658384",
              "versionType": "git"
            },
            {
              "lessThan": "1226293ec9bed3d4cc5b05eeeb811d315ca51652",
              "status": "affected",
              "version": "b6a0ca11186759ad7045d68a5447b1e89f658384",
              "versionType": "git"
            },
            {
              "lessThan": "3750f75f29f99c0223601e2ee73ad084adec47bd",
              "status": "affected",
              "version": "b6a0ca11186759ad7045d68a5447b1e89f658384",
              "versionType": "git"
            },
            {
              "lessThan": "d0ebf9cc7c2ddf95a7cfc654b940bdacb7edde97",
              "status": "affected",
              "version": "b6a0ca11186759ad7045d68a5447b1e89f658384",
              "versionType": "git"
            },
            {
              "lessThan": "0025276175fbbe0dcbf3f84d090b0adee769e9d9",
              "status": "affected",
              "version": "b6a0ca11186759ad7045d68a5447b1e89f658384",
              "versionType": "git"
            },
            {
              "lessThan": "347b59e9f96719d89b6ef555d02a18ada1a5846f",
              "status": "affected",
              "version": "b6a0ca11186759ad7045d68a5447b1e89f658384",
              "versionType": "git"
            },
            {
              "lessThan": "0443e4416aa1ee97748d1ed904eaf3352c60045e",
              "status": "affected",
              "version": "b6a0ca11186759ad7045d68a5447b1e89f658384",
              "versionType": "git"
            },
            {
              "lessThan": "c5371e0b91b24159a3ebaa61e70b0980bcf03c0a",
              "status": "affected",
              "version": "b6a0ca11186759ad7045d68a5447b1e89f658384",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/usbip/vudc.h",
            "drivers/usb/usbip/vudc_dev.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.7"
            },
            {
              "lessThan": "4.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.96",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.261",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.96",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.39",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.4",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusbip: vudc: fix NULL deref in vep_dequeue()\n\nvep_alloc_request() wasn\u0027t initializing vrequest-\u003eudc, so cancellations\non the FunctionFS AIO path were arriving in vep_dequeue without a valid\nUDC reference.\n\nSince vrequest-\u003eudc is never actually properly used anywhere, we opt to\nremove it, and update vep_dequeue to obtain a reference to the udc with\nep_to_vudc(), consistent with the other vep_ ops.\n\nAFAICT this bug has existed for ~10 years. Seems that nobody has really\nstressed the FunctionFS AIO path on usbip\u0027s vudc.\n\nI tested this fix in a QEMU aarch64 guest driving FunctionFS endpoints\nvia AIO. Before the fix, running `usbip attach` from the host would\ncause the guest to oops with the following backtrace:\n\nCall trace:\n vep_dequeue+0x1c/0xe4 (P)\n usb_ep_dequeue+0x14/0x20\n ffs_aio_cancel+0x24/0x34\n __arm64_sys_io_cancel+0xb0/0x124\n do_el0_svc+0x68/0x100\n el0_svc+0x18/0x5c\n el0t_64_sync_handler+0x98/0xdc\n el0t_64_sync+0x154/0x158"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:53:33.891Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/9858c91d9ee6a13c45311569039413729fc9b757"
        },
        {
          "url": "https://git.kernel.org/stable/c/1226293ec9bed3d4cc5b05eeeb811d315ca51652"
        },
        {
          "url": "https://git.kernel.org/stable/c/3750f75f29f99c0223601e2ee73ad084adec47bd"
        },
        {
          "url": "https://git.kernel.org/stable/c/d0ebf9cc7c2ddf95a7cfc654b940bdacb7edde97"
        },
        {
          "url": "https://git.kernel.org/stable/c/0025276175fbbe0dcbf3f84d090b0adee769e9d9"
        },
        {
          "url": "https://git.kernel.org/stable/c/347b59e9f96719d89b6ef555d02a18ada1a5846f"
        },
        {
          "url": "https://git.kernel.org/stable/c/0443e4416aa1ee97748d1ed904eaf3352c60045e"
        },
        {
          "url": "https://git.kernel.org/stable/c/c5371e0b91b24159a3ebaa61e70b0980bcf03c0a"
        }
      ],
      "title": "usbip: vudc: fix NULL deref in vep_dequeue()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64331",
    "datePublished": "2026-07-25T08:49:58.370Z",
    "dateReserved": "2026-07-19T15:36:31.781Z",
    "dateUpdated": "2026-08-17T04:53:33.891Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-64331",
      "date": "2026-09-16",
      "epss": "0.00123",
      "percentile": "0.02341"
    },
    "microsoft_vex": {
      "current_release_date": "2026-07-27T14:43:19.000Z",
      "cve": "CVE-2026-64331",
      "id": "msrc_CVE-2026-64331",
      "initial_release_date": "2026-07-26T01:12:34.000Z",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "usbip: vudc: fix NULL deref in vep_dequeue()",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-64331.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-64331\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-07-25T10:17:14.813\",\"lastModified\":\"2026-09-03T16:04:40.863\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nusbip: vudc: fix NULL deref in vep_dequeue()\\n\\nvep_alloc_request() wasn\u0027t initializing vrequest-\u003eudc, so cancellations\\non the FunctionFS AIO path were arriving in vep_dequeue without a valid\\nUDC reference.\\n\\nSince vrequest-\u003eudc is never actually properly used anywhere, we opt to\\nremove it, and update vep_dequeue to obtain a reference to the udc with\\nep_to_vudc(), consistent with the other vep_ ops.\\n\\nAFAICT this bug has existed for ~10 years. Seems that nobody has really\\nstressed the FunctionFS AIO path on usbip\u0027s vudc.\\n\\nI tested this fix in a QEMU aarch64 guest driving FunctionFS endpoints\\nvia AIO. Before the fix, running `usbip attach` from the host would\\ncause the guest to oops with the following backtrace:\\n\\nCall trace:\\n vep_dequeue+0x1c/0xe4 (P)\\n usb_ep_dequeue+0x14/0x20\\n ffs_aio_cancel+0x24/0x34\\n __arm64_sys_io_cancel+0xb0/0x124\\n do_el0_svc+0x68/0x100\\n el0_svc+0x18/0x5c\\n el0t_64_sync_handler+0x98/0xdc\\n el0t_64_sync+0x154/0x158\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/usb/usbip/vudc.h\",\"drivers/usb/usbip/vudc_dev.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"b6a0ca11186759ad7045d68a5447b1e89f658384\",\"lessThan\":\"9858c91d9ee6a13c45311569039413729fc9b757\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b6a0ca11186759ad7045d68a5447b1e89f658384\",\"lessThan\":\"1226293ec9bed3d4cc5b05eeeb811d315ca51652\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b6a0ca11186759ad7045d68a5447b1e89f658384\",\"lessThan\":\"3750f75f29f99c0223601e2ee73ad084adec47bd\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b6a0ca11186759ad7045d68a5447b1e89f658384\",\"lessThan\":\"d0ebf9cc7c2ddf95a7cfc654b940bdacb7edde97\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b6a0ca11186759ad7045d68a5447b1e89f658384\",\"lessThan\":\"0025276175fbbe0dcbf3f84d090b0adee769e9d9\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b6a0ca11186759ad7045d68a5447b1e89f658384\",\"lessThan\":\"347b59e9f96719d89b6ef555d02a18ada1a5846f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b6a0ca11186759ad7045d68a5447b1e89f658384\",\"lessThan\":\"0443e4416aa1ee97748d1ed904eaf3352c60045e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b6a0ca11186759ad7045d68a5447b1e89f658384\",\"lessThan\":\"c5371e0b91b24159a3ebaa61e70b0980bcf03c0a\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/usb/usbip/vudc.h\",\"drivers/usb/usbip/vudc_dev.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.7\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.7\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.261\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.212\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.178\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.145\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.96\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.39\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.4\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-476\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.7\",\"versionEndExcluding\":\"5.10.261\",\"matchCriteriaId\":\"2134D243-59E9-4263-9C61-720BA5294D93\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.212\",\"matchCriteriaId\":\"8E99FB01-CD93-41AF-A653-3F450652B9A6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.178\",\"matchCriteriaId\":\"092233C7-F4E0-40C8-BD4D-A28FE50DFE20\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.145\",\"matchCriteriaId\":\"7046B092-F810-4440-ACE6-60218518EECE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.96\",\"matchCriteriaId\":\"38A8100E-2B1A-462F-AEE9-8901B870FEF2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.18.39\",\"matchCriteriaId\":\"914AE4BC-3D59-4C5A-9DB5-9CE327B429F7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.19\",\"versionEndExcluding\":\"7.1.4\",\"matchCriteriaId\":\"6228DDD6-4557-4AA3-9F43-AB995D471E42\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.2:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"5E8B9085-7ADB-4A05-89EF-12949B6A0509\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.2:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"1FC0D50D-9D58-4947-A197-A5A3FF07E7E3\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0025276175fbbe0dcbf3f84d090b0adee769e9d9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/0443e4416aa1ee97748d1ed904eaf3352c60045e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/1226293ec9bed3d4cc5b05eeeb811d315ca51652\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/347b59e9f96719d89b6ef555d02a18ada1a5846f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/3750f75f29f99c0223601e2ee73ad084adec47bd\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9858c91d9ee6a13c45311569039413729fc9b757\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c5371e0b91b24159a3ebaa61e70b0980bcf03c0a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d0ebf9cc7c2ddf95a7cfc654b940bdacb7edde97\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-07-27T09:34:49+00:00",
      "cve": "CVE-2026-64331",
      "id": "CVE-2026-64331",
      "initial_release_date": "2026-07-25T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: usbip: vudc: fix NULL deref in vep_dequeue()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64331.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-15T01:51:49Z",
      "cve": "CVE-2026-64331",
      "id": "CVE-2026-64331",
      "initial_release_date": "2026-07-25T16:01:42Z",
      "product_status:first_fixed": "65",
      "product_status:known_affected": "669",
      "product_status:known_not_affected": "80",
      "product_status:recommended": "46",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-64331",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-64331.json",
      "version": "10"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.