CVE-2026-64464xhci: sideband: fix ring sg table pages leak
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: xhci: sideband: fix ring sg table pages leak xhci_ring_to_sgtable() allocates a temporary pages array and uses it to build the returned sg_table with sg_alloc_table_from_pages(). The error paths free the pages array, but the success path returns the sg_table without freeing it. This leaks the temporary array every time a sideband client gets an endpoint or event ring buffer. Free the pages array after sg_alloc_table_from_pages() succeeds. The returned sg_table has its own scatterlist entries and does not depend on the temporary array after construction.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Aug 17, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from de66754e9f8029f8ae955a588959b99cab56b506 before 99d00a9e35e311a91d258029d5bb584377296c34; from de66754e9f8029f8ae955a588959b99cab56b506 before a3eaf82ff842d6ca95937ea584417e04828235a6; from de66754e9f8029f8ae955a588959b99cab56b506 before 49f6e3c3ef19f04f6657ed8dce550e36c763abb8 | CNA record |
References
- https://git.kernel.org/stable/c/99d00a9e35e311a91d258029d5bb584377296c34
- https://git.kernel.org/stable/c/a3eaf82ff842d6ca95937ea584417e04828235a6
- https://git.kernel.org/stable/c/49f6e3c3ef19f04f6657ed8dce550e36c763abb8
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.