CVE-2026-64454 — usb: dwc3: run gadget disconnect from sleepable suspend context
In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: run gadget disconnect from sleepable suspend context dwc3_gadget_suspend() takes dwc->lock with IRQs disabled and then calls dwc3_disconnect_gadget(). For async callbacks that helper only uses plain spin_unlock()/spin_lock(), so the gadget ->disconnect() callback still runs with IRQs disabled and any sleepable callback trips Lockdep. This issue was found by our static analysis tool and then manually reviewed against the current tree. The grounded PoC kept the dwc3_gadget_suspend() -> dwc3_disconnect_gadget() -> gadget_driver->disconnect() chain, and Lockdep reported: BUG: sleeping function called from invalid context gadget_disconnect+0x21/0x39 [vuln_msv] dwc3_gadget_suspend.constprop.0+0x2b/0x42 [vuln_msv] Keep the disconnect callback selection in one common helper, but add a sleepable suspend-side wrapper which snapshots the callback under dwc->lock and then runs it after spin_unlock_irqrestore(). The regular event path still uses the existing spin_unlock()/spin_lock() window.
Who exploits it and how urgent it is
A 0–100 score combining confirmed exploitation, ransomware and APT use, public exploits, EPSS and severity.
How the score was calculated
- No scoring signals.
The score orders the patch queue; it does not replace your asset context (internet exposure, criticality, compensating controls).
Triage
Is it exploited, how likely is exploitation, what does it touch, and how severe do the sources call it.
Remediation
Fixes and mitigations documented by the sources — linked to the original advisory.
No fix documented by the sources we poll. That does not mean none exists: check the vendor advisory.
First 24 hours
Ordered from the record’s own fields — exposure first, because you cannot patch what you have not found. A rule-generated starting point.
- Identify exposed assets running the affected vendor/product/version combinations (Linux Linux).
- No fix documented in the sources: reduce exposure and monitor the vendor advisory.
- Search available logs for exploit probes, errors and authentication anomalies.
Affected scope
Vendor, product and versions as the sources word them.
| Vendor | Product | Versions | Status | Source |
|---|---|---|---|---|
| Linux | Linux |
≥ 20351ddb1f41cfb3ae20e105425ef43a28393d76 and < b399be2958456efe1b64b19c55a54a24e9035769≥ ad43004fd5326bec4466ecc8a07fe0e570b553ca and < 48958478cb8dbc429a5b19f36e866b63d6297d1d≥ c8540870af4ce6ddeb27a7bb5498b75fb29b643c and < 5e5798880eb1533a7de6fb68eb14b2d8202ebf76≥ c8540870af4ce6ddeb27a7bb5498b75fb29b643c and < e0e4f15d4225fb7156cc0e3c21eb8953114f9b89≥ c8540870af4ce6ddeb27a7bb5498b75fb29b643c and < c4e232bd07fe2b69a6e5c380db41dd36b95e0524≥ c8540870af4ce6ddeb27a7bb5498b75fb29b643c and < 642e04f5c292d04070ae6e4374fbf14cc40a2465≥ c8540870af4ce6ddeb27a7bb5498b75fb29b643c and < 010382937fb69892b3469ac4d30af072262f59e8version 06684c72b6b153dc434bb6ccebbb49f4cd812b5e and 4 more≥ 5.15.128 and < 5.15.212≥ 6.1.30 and < 6.1.178≥ 6.3.4 and < 6.4version 6.4 |
Vulnerable | CVE Program (cve.org) e CISA ADP |
Detection
Read off the CVSS vector and the weakness class. Starting points, not tested rules.
- Not enough vector or weakness data: use the affected application’s logs as a starting point.
Timeline
What happened to this CVE, newest first.
- 2026
- Record published
- Affected products added · linux/linux
- Source status changed · → Received
- Record created in this database
- CVE published
Source activity
Repeated readings are counted rather than listed.
- 1× Official description updated · Oct 15, 2026 – Oct 15, 2026
References
7 on the record
- git.kernel.org/stable/c/010382937fb69892b3469ac4d30af072262f59e8
- git.kernel.org/stable/c/b399be2958456efe1b64b19c55a54a24e9035769
- git.kernel.org/stable/c/c4e232bd07fe2b69a6e5c380db41dd36b95e0524
- git.kernel.org/stable/c/642e04f5c292d04070ae6e4374fbf14cc40a2465
- git.kernel.org/stable/c/48958478cb8dbc429a5b19f36e866b63d6297d1d
- git.kernel.org/stable/c/5e5798880eb1533a7de6fb68eb14b2d8202ebf76
- git.kernel.org/stable/c/e0e4f15d4225fb7156cc0e3c21eb8953114f9b89
Elsewhere on this site
Related CVEs (same products)
- Critical CVE-2026-99999 ipv4: validate checksum_start before completing checksum 11h
- Unknown CVE-2026-98432 ipv4: free inet_opt and ireq_opt after an RCU grace period 11h
- Unknown CVE-2026-98424 wifi: cfg80211: undo netns switch if renaming the wiphy fails 1d
- Unknown CVE-2026-98425 wifi: mac80211: don't warn when an IBSS has no channel to scan 1d
- Unknown CVE-2026-98426 wifi: mwifiex: fix IRQ leak using wrong index in MSI-X error path 1d
- Unknown CVE-2026-98427 net/sched: codel: bound the dropping loop per dequeue call 1d
Not in any source we poll
Listed rather than left blank: an empty field and an unmeasured one look identical on screen, and only one is a reason to look elsewhere.
- No CVSS score published by NVD, the CNA, CISA or GitHub so far.
- No FIRST EPSS score.
- No fixed version, patch or mitigation documented.
- No CISA SSVC assessment.
- No CWE classification.
- No confirmed IOCs, IP addresses, domains, file hashes, or malware artifacts supplied.
- No organization-specific asset inventory, compensating-control status, or patch deployment evidence supplied.
- No exploit packet captures, log samples, or incident case IDs supplied.
Answered from this record
Text assembled only from the fields above — no additional claims.
What should defenders know first?
CVE-2026-64454 is "usb: dwc3: run gadget disconnect from sleepable suspend context", rated Unknown. It affects Linux (Linux); versions are in the scope table. It is not in CISA KEV, which does not rule out exploitation. First verify whether exposed or business-critical assets run the affected versions, apply vendor fixes or mitigations, and preserve logs for review.
Comments
Moderated technical discussion. Read the community guidelines.
No comments yet.
Sign in or create an account to comment and suggest corrections.