What is CVE-2026-64337?

CVE-2026-64337 is a Medium severity Linux kernel vulnerability with a CVSS score of 5.5 out of 10, affecting Linux kernel versions from 4.10 onward and patched in 5.10.261, 5.15.212, 6.1.178 and others. CVE-2026-64337 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.

What is the CVSS score for CVE-2026-64337?

CVE-2026-64337 has a CVSS score of 5.5 out of 10, rated Medium severity. The vector string is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.

Is there a patch available for CVE-2026-64337?

Yes, CVE-2026-64337 has been patched. Fixed versions include 5.10.261, 5.15.212, 6.1.178 and others. If you are running Linux kernel 4.10 or later up to the fix versions, apply the relevant patch for your kernel branch.

Is CVE-2026-64337 actively exploited?

CVE-2026-64337 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.

CVE-2026-64337

Medium

In the Linux kernel, the following vulnerability has been resolved: usb: mtu3: unmap request DMA on queue failure mtu3_gadget_queue() maps the request before checking whether the QMU GPD ring can accept another transfer. the request is returned with -EAGAIN before it is linked on the endpoint request list if mtu3_prepare_transfer() fails. Normal completion and dequeue paths unmap requests from mtu3_req_complete(), but this error path never reaches that helper, so the DMA mapping is left active. Unmap the request before returning from the failed queue path.

Package Linux Kernel

Published 2026-07-25

Last modified 2026-09-03

CVSS version 3.1

Patch available

Yes

CVSS 3.1 score

5.5

out of 10

Medium

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

High

Vector string

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected versions

Linux kernel versions 4.10 and later are affected. Fixed in 5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.96, 6.18.39, 7.1.4, 7.2 and their respective stable series.

Affected from

≥ 4.10

Fixed in

✓ 5.10.261 5.10.x ✓ 5.15.212 5.15.x ✓ 6.1.178 6.1.x ✓ 6.6.145 6.6.x ✓ 6.12.96 6.12.x ✓ 6.18.39 6.18.x ✓ 7.1.4 7.1.x ✓ 7.2

References

8 total

Kernel Git
https://git.kernel.org/stable/c/00c3fef4c2dc2c7cbd8281f8fda09d1913420f09

Patch
Kernel Git
https://git.kernel.org/stable/c/0bddda5a11665c210339de76d27ebbd1a2e0b43c

Patch
Kernel Git
https://git.kernel.org/stable/c/3cee30f1138281a1d247bb053a1ad4f7c5b04e98

Patch
Kernel Git
https://git.kernel.org/stable/c/4183874b7925f4a98b400cf857bea26ee87da236

Patch
Kernel Git
https://git.kernel.org/stable/c/835b0596d4c9bdef93f842d8f826978fb4956b74

Patch

Showing 5 of 8 references View all on NVD

Details

CVE ID CVE-2026-64337

Severity Medium

CVSS score 5.5 / 10

CVSS version 3.1

Published 2026-07-25

Modified 2026-09-03

KEV No

Patch

Yes

Package linux

Frequently asked questions

What is CVE-2026-64337?

CVE-2026-64337 is a Medium severity Linux kernel vulnerability with a CVSS score of 5.5 out of 10 . It affects Linux kernel versions from 4.10 onward and has been patched in 5.10.261, 5.15.212, 6.1.178 and others. CVE-2026-64337 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
What is the CVSS score for CVE-2026-64337?

CVE-2026-64337 has a CVSS score of 5.5 out of 10, rated Medium severity (CVSS 3.1). The vector string is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.
Is there a patch available for CVE-2026-64337?

Yes. CVE-2026-64337 has been patched. Fixed versions include 5.10.261, 5.15.212, 6.1.178 and others. If you are running Linux kernel 4.10 or later up to the fix versions, apply the relevant patch for your kernel branch.
Is CVE-2026-64337 actively exploited?

No. CVE-2026-64337 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.