Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-64349

In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: fix dwc3_readl()…

Risk score
48/100
CVSS
5.5 v3.1
Published
25 Jul 2026

Open in the live forecast Today's forecast

What to know

What it is
In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: fix dwc3_readl() and dwc3_writel() calls in dwc3_ulpi_setup() The dwc3_ulpi_setup() calls the register read and write calls with dwc3->regs when both these calls take the dwc3 structure directly. Chnage these two calls to fix the following …
Affected
Linux kernel
Fix
Apply the vendor's security update; see the linked advisory.
Exploitation
No known exploitation

Story map

Story map: Linux kernelTHE FLAWSTHE FIXCVE-2026-64349In the Linux kernel, thefollowing vulnerability has beenresolved: usb: dwc3: fix…CVSS 5.5CVE-2026-98096Out-of-bounds writeCVSS 7.4 · EPSS 1%CVE-2026-98115Race conditionCVSS 8.8 · EPSS 0%CVE-2026-98117Use-after-freeCVSS 7.8 · EPSS 0%FixApply the vendor's securityupdate; see the linked advisory.Who is exposedLinux kernelAMBER · PATCH THIS WEEKLinux kernelIn the Linux kernel, thefollowing vulnerability has beenresolved: ipv6: sr: restorenetwork header before routingand forwarding ipv6_srh_rcv()runs with skb->data at theSegment Routing Header (SRH)…Where it standsNo known exploitationHOW IT UNFOLDEDOfficial record on the left, the press on the right, oldest first.6 Nov · Ubuntu security noticesUSN-9003-1: Linux kernel (NVIDIA) vulnerabilitiesCONNECTS TOSame weaknessOut-of-bounds write (CWE-787)399 other warnings in 30 days →Same productEarlier Linux kernel warnings140 in the last 90 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Linux kernel: Amber, patch this week. In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: restore network header before routing and forwarding ipv6_srh_rcv() runs with skb->data at the Segment Routing Header (SRH) while skb_network_header() points at the IPv6 header. When segments_left > 0, ipv6_srh_rcv() previously restored the …

The flaws

  • CVE-2026-64349: In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: fix dwc3_readl()… (CVSS 5.5)
  • CVE-2026-98096: Out-of-bounds write (CVSS 7.4 · EPSS 1%)
  • CVE-2026-98115: Race condition (CVSS 8.8 · EPSS 0%)
  • CVE-2026-98117: Use-after-free (CVSS 7.8 · EPSS 0%)

The fix

Fix: Apply the vendor's security update; see the linked advisory.

Who is exposed: Linux kernel

Where it stands

  • No known exploitation

How it unfolded

  1. 6 Nov, Ubuntu security notices (official): USN-9003-1: Linux kernel (NVIDIA) vulnerabilities

Connects to

Why it is Yellow

  • CVSS 5.5 medium
  • On your watchlist: linux kernel
  • Named in a government or vendor bulletin

Government and vendor bulletins

References

Original description

In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: fix dwc3_readl() and dwc3_writel() calls in dwc3_ulpi_setup() The dwc3_ulpi_setup() calls the register read and write calls with dwc3->regs when both these calls take the dwc3 structure directly. Chnage these two calls to fix the following sparse warning, and possibly a nasty bug in the dwc3_ulpi_setup() code: drivers/usb/dwc3/core.c:796:45: warning: incorrect type in argument 1 (different address spaces) drivers/usb/dwc3/core.c:796:45: expected struct dwc3 *dwc drivers/usb/dwc3/core.c:796:45: got void [noderef] __iomem *regs drivers/usb/dwc3/core.c:798:40: warning: incorrect type in argument 1 (different address spaces) drivers/usb/dwc3/core.c:798:40: expected struct dwc3 *dwc drivers/usb/dwc3/core.c:798:40: got void [noderef] __iomem *regs

Last activity 6 Nov 2026. Patch Forecast updates every hour.