Reference page — cumulative record through Sunday, October 4, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC PR UI S C I A CVSS EPSS %ile KEV L L L N U N N H 5.5 .0016 4.5 —
AFFECTED Product Versions Fixed Linux df2069acb00569a6299d6e11aa1865eeba463848 – — Linux 4.10 – 5.10.261
TIMELINE Jul 19 Reserved by Linux Jul 25 Published (CNA: Linux) Sep 3 ENRICHED — CVE-2026-64337 (Linux). Received CVSS 5.5 and CPE data from NVD.
In the Linux kernel, the following vulnerability has been resolved: usb: mtu3: unmap request DMA on queue failure mtu3_gadget_queue() maps the request before checking whether the QMU GPD ring can accept another transfer. the request is returned with -EAGAIN before it is linked on the endpoint request list if mtu3_prepare_transfer() fails. Normal completion and dequeue paths unmap requests from mtu3_req_complete(), but this error path never reaches that helper, so the DMA mapping is left active. Unmap the request before returning from the failed queue path.
| Date | Event | Detail |
|---|---|---|
| July 19, 2026 | Reserved | Reserved by Linux |
| July 25, 2026 | Published | Published (CNA: Linux) |
| September 3, 2026 | ENRICHED | ENRICHED — CVE-2026-64337 (Linux). Received CVSS 5.5 and CPE data from NVD. |
Authoritative record: CVE-2026-64337 at cve.org
Vendors: linux
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-64337 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Sunday, October 4, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.
