CVE-2026-64350

usb: cdnsp: fix stream context array leak in cdnsp_alloc_stream_info()

State: Published
Severity: Not scored
Published: Jul 25, 2026
Updated: Aug 17, 2026
Reserved: Jul 19, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

usb: cdnsp: fix stream context array leak in cdnsp_alloc_stream_info()

cdnsp_alloc_stream_info() allocates stream_info->stream_ctx_array with cdnsp_alloc_stream_ctx(). If a later stream ring allocation or stream mapping update fails, the error path frees the allocated stream rings and stream_rings array, but leaves stream_ctx_array allocated.

Free the stream context array before falling through to the stream_rings cleanup path.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	3d82904559f4f5a2622db1b21de3edf2eded7664 to before 37283f5a47127fbdea567749a2110766af53d18dAffected 3d82904559f4f5a2622db1b21de3edf2eded7664 to before cb8e9391b7f4f77d112c51910cd7c355a337ef76Affected 3d82904559f4f5a2622db1b21de3edf2eded7664 to before fde3c095e1d48e0ac3ab8bc32905da42fe58a36aAffected 3d82904559f4f5a2622db1b21de3edf2eded7664 to before d9643bbe93a6aee24edee1a86e0303aa74bcd320Affected 3d82904559f4f5a2622db1b21de3edf2eded7664 to before c00826e87bb75e14e0381b05da5f18ffd0241ab6Affected 3d82904559f4f5a2622db1b21de3edf2eded7664 to before 963075c4da0cd43b3d17b107c355e1eb0ee64a58Affected 3d82904559f4f5a2622db1b21de3edf2eded7664 to before 3348f444a4ce43dd5c2d1aa41634cb6eff33aa64Affected
LinuxLinux	5.12Affected before 5.12Not affected 5.15.212 through 5.15.Not affected 6.1.178 through 6.1.Not affected 6.6.145 through 6.6.Not affected 6.12.96 through 6.12.Not affected 6.18.39 through 6.18.Not affected 7.1.4 through 7.1.Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

3d82904559f4f5a2622db1b21de3edf2eded7664 to before 37283f5a47127fbdea567749a2110766af53d18dAffected
3d82904559f4f5a2622db1b21de3edf2eded7664 to before cb8e9391b7f4f77d112c51910cd7c355a337ef76Affected
3d82904559f4f5a2622db1b21de3edf2eded7664 to before fde3c095e1d48e0ac3ab8bc32905da42fe58a36aAffected
3d82904559f4f5a2622db1b21de3edf2eded7664 to before d9643bbe93a6aee24edee1a86e0303aa74bcd320Affected
3d82904559f4f5a2622db1b21de3edf2eded7664 to before c00826e87bb75e14e0381b05da5f18ffd0241ab6Affected
3d82904559f4f5a2622db1b21de3edf2eded7664 to before 963075c4da0cd43b3d17b107c355e1eb0ee64a58Affected
3d82904559f4f5a2622db1b21de3edf2eded7664 to before 3348f444a4ce43dd5c2d1aa41634cb6eff33aa64Affected

LinuxLinux

5.12Affected
before 5.12Not affected
5.15.212 through 5.15.*Not affected
6.1.178 through 6.1.*Not affected
6.6.145 through 6.6.*Not affected
6.12.96 through 6.12.*Not affected
6.18.39 through 6.18.*Not affected
7.1.4 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.