{"cvss":0.0,"datePublished":"2026-07-25T10:17:31.660","dateUpdated":"2026-11-03T18:15:39.353","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nxhci: sideband: fix ring sg table pages leak\n\nxhci_ring_to_sgtable() allocates a temporary pages array and\nuses it to build the returned sg_table with\nsg_alloc_table_from_pages().\n\nThe error paths free the pages array, but the success path\nreturns the sg_table without freeing it. This leaks the temporary\narray every time a sideband client gets an endpoint or event ring\nbuffer.\n\nFree the pages array after sg_alloc_table_from_pages() succeeds.\nThe returned sg_table has its own scatterlist entries and does not\ndepend on the temporary array after construction.","id":"CVE-2026-64464","raw":{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/usb/host/xhci-sideband.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"99d00a9e35e311a91d258029d5bb584377296c34","status":"affected","version":"de66754e9f8029f8ae955a588959b99cab56b506","versionType":"git"},{"lessThan":"a3eaf82ff842d6ca95937ea584417e04828235a6","status":"affected","version":"de66754e9f8029f8ae955a588959b99cab56b506","versionType":"git"},{"lessThan":"49f6e3c3ef19f04f6657ed8dce550e36c763abb8","status":"affected","version":"de66754e9f8029f8ae955a588959b99cab56b506","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/usb/host/xhci-sideband.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.16"},{"lessThan":"6.16","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.39","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.4","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nxhci: sideband: fix ring sg table pages leak\n\nxhci_ring_to_sgtable() allocates a temporary pages array and\nuses it to build the returned sg_table with\nsg_alloc_table_from_pages().\n\nThe error paths free the pages array, but the success path\nreturns the sg_table without freeing it. This leaks the temporary\narray every time a sideband client gets an endpoint or event ring\nbuffer.\n\nFree the pages array after sg_alloc_table_from_pages() succeeds.\nThe returned sg_table has its own scatterlist entries and does not\ndepend on the temporary array after construction."}],"id":"CVE-2026-64464","lastModified":"2026-11-03T18:15:39.353","metrics":{},"published":"2026-07-25T10:17:31.660","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/49f6e3c3ef19f04f6657ed8dce550e36c763abb8"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/99d00a9e35e311a91d258029d5bb584377296c34"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/a3eaf82ff842d6ca95937ea584417e04828235a6"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Awaiting Analysis"},"severity":"UNKNOWN","source":"nvd","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nxhci: sideband: fix ring sg table pages leak\n\nxh..."}