CVE-2026-64331
In the Linux kernel, the following vulnerability has been resolved:
usbip: vudc: fix NULL deref in vep_dequeue()
vep_alloc_request() wasn't initializing vrequest->udc, so cancellations
on the FunctionFS AIO path were arriving in vep_dequeue without a valid
UDC reference.
Since vrequest->udc is never actually properly used anywhere, we opt to
remove it, and update vep_dequeue to obtain a reference to the udc with
ep_to_vudc(), consistent with the other vep_ ops.
AFAICT this bug has existed for ~10 years. Seems that nobody has really
stressed the FunctionFS AIO path on usbip's vudc.
I tested this fix in a QEMU aarch64 guest driving FunctionFS endpoints
via AIO. Before the fix, running usbip attach from the host would
cause the guest to oops with the following backtrace:
Call trace:
vep_dequeue+0x1c/0xe4 (P)
usb_ep_dequeue+0x14/0x20
ffs_aio_cancel+0x24/0x34
__arm64_sys_io_cancel+0xb0/0x124
do_el0_svc+0x68/0x100
el0_svc+0x18/0x5c
el0t_64_sync_handler+0x98/0xdc
el0t_64_sync+0x154/0x158
CSIRTS triage
- What
- This vulnerability addresses a NULL dereference in the vep_dequeue() function.
- Who is affected
- Deployments using the usbip subsystem.
- Urgency
- Remediation is advised to avoid potential crashes, although there are no known exploits.
- Action
- Apply the fix for the NULL dereference in vep_dequeue().
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch CVE-2026-64331
Get an email if CVE-2026-64331 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.
Exploitation outlook
- Low exploitation risk0.18% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 7% of all EPSS-scored CVEs.
Advisory coverage (2)
- unknownCVE-2026-64331: In the Linux kernel, the following vulnerability has been resolved: usbip: vudc: fix NULL dere…nvd · 2026-07-25
- mediumCVE-2026-64331: usbip: vudc: fix NULL deref in vep_dequeue()msrc · 2026-07-14
External references
Embed the live status
— this badge updates automatically when the KEV or exploit status changes. How to embed it →
[](https://www.csirts.com/cve/CVE-2026-64331)