CVE-2026-64454 - Vulnerability Details

- usb: dwc3: run gadget disconnect from sleepable suspend context

Description

In the Linux kernel, the following vulnerability has been resolved:

usb: dwc3: run gadget disconnect from sleepable suspend context

dwc3_gadget_suspend() takes dwc->lock with IRQs disabled and then calls
dwc3_disconnect_gadget(). For async callbacks that helper only uses
plain spin_unlock()/spin_lock(), so the gadget ->disconnect() callback
still runs with IRQs disabled and any sleepable callback trips Lockdep.

This issue was found by our static analysis tool and then manually
reviewed against the current tree.

The grounded PoC kept the dwc3_gadget_suspend() ->
dwc3_disconnect_gadget() -> gadget_driver->disconnect() chain, and
Lockdep reported:

BUG: sleeping function called from invalid context
gadget_disconnect+0x21/0x39 [vuln_msv]
dwc3_gadget_suspend.constprop.0+0x2b/0x42 [vuln_msv]

Keep the disconnect callback selection in one common helper, but add a
sleepable suspend-side wrapper which snapshots the callback under
dwc->lock and then runs it after spin_unlock_irqrestore(). The regular
event path still uses the existing spin_unlock()/spin_lock() window.

Published: 2026-07-25

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The bug occurs when the USB gadget driver’s disconnect callback is executed while device interrupts are disabled, causing a sleepable function to run from an invalid context. This can trigger a kernel panic or deadlock, effectively taking the system offline. The flaw arises from improper synchronization between the dwc3 gadget suspend routine and its disconnect handler, leading to a violation of the kernel’s lockdep constraints.

Affected Systems

All Linux kernel builds that include the dwc3 gadget driver without the recent fix are affected. Specific version details are not listed in the CVE data, so any kernel where this code path is present is potentially vulnerable.

Risk and Exploitability

The EPSS score of less than 1% indicates a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. No known remote exploitation vectors exist; the vulnerability appears to be exploitable only from a local context, such as an attacker who can control USB gadget operations. The impact is primarily denial of service rather than data compromise.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`20351ddb1f41cfb3ae20e105425ef43a28393d76`	affected	< b399be2958456efe1b64b19c55a54a24e9035769
`ad43004fd5326bec4466ecc8a07fe0e570b553ca`	affected	< 48958478cb8dbc429a5b19f36e866b63d6297d1d
`c8540870af4ce6ddeb27a7bb5498b75fb29b643c`	affected	< 5e5798880eb1533a7de6fb68eb14b2d8202ebf76
`c8540870af4ce6ddeb27a7bb5498b75fb29b643c`	affected	< e0e4f15d4225fb7156cc0e3c21eb8953114f9b89
`c8540870af4ce6ddeb27a7bb5498b75fb29b643c`	affected	< c4e232bd07fe2b69a6e5c380db41dd36b95e0524
`c8540870af4ce6ddeb27a7bb5498b75fb29b643c`	affected	< 642e04f5c292d04070ae6e4374fbf14cc40a2465
`c8540870af4ce6ddeb27a7bb5498b75fb29b643c`	affected	< 010382937fb69892b3469ac4d30af072262f59e8
`06684c72b6b153dc434bb6ccebbb49f4cd812b5e`	affected	—
`5.15.128`	affected	< 5.15.212
`6.1.30`	affected	< 6.1.178
`6.3.4`	affected	< 6.4

Linux

affected

Version	Status	Constraints
`6.4`	affected	—
`0`	unaffected	< 6.4
`5.15.212`	unaffected	≤ 5.15.*
`6.1.178`	unaffected	≤ 6.1.*
`6.6.145`	unaffected	≤ 6.6.*
`6.12.96`	unaffected	≤ 6.12.*
`6.18.39`	unaffected	≤ 6.18.*
`7.1.4`	unaffected	≤ 7.1.*
`7.2-rc3`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[20351ddb1f41cfb3ae20e105425ef43a28393d76,b399be2958456efe1b64b19c55a54a24e9035769)`	affected	code_commit	—
`[ad43004fd5326bec4466ecc8a07fe0e570b553ca,48958478cb8dbc429a5b19f36e866b63d6297d1d)`	affected	code_commit	—
`[c8540870af4ce6ddeb27a7bb5498b75fb29b643c,5e5798880eb1533a7de6fb68eb14b2d8202ebf76)`	affected	code_commit	—
`[c8540870af4ce6ddeb27a7bb5498b75fb29b643c,642e04f5c292d04070ae6e4374fbf14cc40a2465)`	affected	code_commit	—
`[c8540870af4ce6ddeb27a7bb5498b75fb29b643c,e0e4f15d4225fb7156cc0e3c21eb8953114f9b89)`	affected	code_commit	—
`[c8540870af4ce6ddeb27a7bb5498b75fb29b643c,c4e232bd07fe2b69a6e5c380db41dd36b95e0524)`	affected	code_commit	—
`[c8540870af4ce6ddeb27a7bb5498b75fb29b643c,010382937fb69892b3469ac4d30af072262f59e8)`	affected	code_commit	—
`06684c72b6b153dc434bb6ccebbb49f4cd812b5e`	affected	code_commit	—
`[5.15.128,5.15.212)`	affected	semver	—
`[6.1.30,6.1.178)`	affected	semver	—
`[6.3.4,6.4)`	affected	semver	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`6.4`	affected	semver	—
`[0,6.4)`	unaffected	semver	—
`[5.15.212,5.15.*]`	unaffected	generic	—
`[6.1.178,6.1.*]`	unaffected	generic	—
`[6.6.145,6.6.*]`	unaffected	generic	—
`[6.12.96,6.12.*]`	unaffected	generic	—
`[6.18.39,6.18.*]`	unaffected	generic	—
`[7.1.4,7.1.*]`	unaffected	generic	—
`[7.2-rc3,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade the Linux kernel to a version that includes the fix for the dwc3 gadget disconnect issue.
If an upgrade is not immediately possible, disable or restrict the use of USB gadget drivers that rely on dwc3 to prevent triggering the bug.
Continuously monitor system logs for kernel panic messages related to USB gadget disconnect and apply the patch as soon as it becomes available.

Generated by OpenCVE AI on August 2, 2026 at 12:36 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4720-1	linux security update
Debian DLA	DLA-4723-1	linux-6.1 security update
Debian DLA	DLA-4724-1	linux-6.12 new package

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.0018.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/010382937fb69892b3469ac4d30af072262f59e8
https://git.kernel.org/stable/c/48958478cb8dbc429a5b19f36e866b63d6297d1d
https://git.kernel.org/stable/c/5e5798880eb1533a7de6fb68eb14b2d8202ebf76
https://git.kernel.org/stable/c/642e04f5c292d04070ae6e4374fbf14cc40a2465
https://git.kernel.org/stable/c/b399be2958456efe1b64b19c55a54a24e9035769
https://git.kernel.org/stable/c/c4e232bd07fe2b69a6e5c380db41dd36b95e0524
https://git.kernel.org/stable/c/e0e4f15d4225fb7156cc0e3c21eb8953114f9b89
https://lore.kernel.org/linux-cve-announce/2026072541-CVE-2026-64454-10fc@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-64454
https://www.cve.org/CVERecord?id=CVE-2026-64454

History

Sat, 01 Aug 2026 02:00:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-362 CWE-367

Thu, 30 Jul 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-663
References		https://lore.kernel.org/linux-cve-announce/2026072541-CVE-2026-64454-10fc@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-64454 https://www.cve.org/CVERecord?id=CVE-2026-64454
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Sun, 26 Jul 2026 01:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-362 CWE-367

Sat, 25 Jul 2026 09:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: run gadget disconnect from sleepable suspend context dwc3_gadget_suspend() takes dwc->lock with IRQs disabled and then calls dwc3_disconnect_gadget(). For async callbacks that helper only uses plain spin_unlock()/spin_lock(), so the gadget ->disconnect() callback still runs with IRQs disabled and any sleepable callback trips Lockdep. This issue was found by our static analysis tool and then manually reviewed against the current tree. The grounded PoC kept the dwc3_gadget_suspend() -> dwc3_disconnect_gadget() -> gadget_driver->disconnect() chain, and Lockdep reported: BUG: sleeping function called from invalid context gadget_disconnect+0x21/0x39 [vuln_msv] dwc3_gadget_suspend.constprop.0+0x2b/0x42 [vuln_msv] Keep the disconnect callback selection in one common helper, but add a sleepable suspend-side wrapper which snapshots the callback under dwc->lock and then runs it after spin_unlock_irqrestore(). The regular event path still uses the existing spin_unlock()/spin_lock() window.
Title		usb: dwc3: run gadget disconnect from sleepable suspend context
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/010382937fb69892b3469ac4d30af072262f59e8 https://git.kernel.org/stable/c/48958478cb8dbc429a5b19f36e866b63d6297d1d https://git.kernel.org/stable/c/5e5798880eb1533a7de6fb68eb14b2d8202ebf76 https://git.kernel.org/stable/c/642e04f5c292d04070ae6e4374fbf14cc40a2465 https://git.kernel.org/stable/c/b399be2958456efe1b64b19c55a54a24e9035769 https://git.kernel.org/stable/c/c4e232bd07fe2b69a6e5c380db41dd36b95e0524 https://git.kernel.org/stable/c/e0e4f15d4225fb7156cc0e3c21eb8953114f9b89

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-07-25T08:51:23.212Z

Updated: 2026-07-25T08:51:23.212Z

Reserved: 2026-07-19T15:36:31.789Z

Link: CVE-2026-64454

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-07-25T10:17:30.407

Modified: 2026-07-25T10:17:30.407

Link: CVE-2026-64454

Redhat

Severity : Moderate

Publid Date: 2026-07-25T00:00:00Z

Links: CVE-2026-64454 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-02T12:45:06Z

Weaknesses

CWE-663
Use of a Non-reentrant Function in a Concurrent Context

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object