CVE-2026-64348: usb: free iso schedules on failed submit

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

usb: free iso schedules on failed submit

EHCI and FOTG210 isochronous submits build an ehci_iso_sched before
linking the URB to the endpoint queue, and keep the staged schedule in
urb->hcpriv until iso_stream_schedule() and the link helpers consume it.
If the controller is no longer accessible, or usb_hcd_link_urb_to_ep()
fails, submit jumps to done_not_linked before that handoff happens and
leaks the staged schedule still attached to urb->hcpriv.

Free the staged schedule from done_not_linked when submit fails before
the URB is linked and clear urb->hcpriv after the free.

The bug was first flagged by an experimental analysis tool we are
developing for kernel memory-management bugs while analyzing
v6.13-rc1. The tool is still under development and is not yet publicly
available. Manual inspection confirms that the bug is still
present in v7.1.1.

An x86_64 allyesconfig build showed no new warnings. As we do not have an
EHCI host controller with a USB isochronous device to test with, no
runtime testing was able to be performed.

The Linux kernel CVE team has assigned CVE-2026-64348 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 2.6.15 with commit 8de98402652c01839ae321be6cb3054cf5735d83 and fixed in 5.10.261 with commit b0d00d077f9738d215af9b50c74dffab7a1de19f
	Issue introduced in 2.6.15 with commit 8de98402652c01839ae321be6cb3054cf5735d83 and fixed in 6.6.145 with commit be5004395dfd0b6ec310db359f887fa396fd0dd2
	Issue introduced in 2.6.15 with commit 8de98402652c01839ae321be6cb3054cf5735d83 and fixed in 6.12.96 with commit 8890699eea19027ef6e4f9cbcf27cba5e789793f
	Issue introduced in 2.6.15 with commit 8de98402652c01839ae321be6cb3054cf5735d83 and fixed in 6.18.39 with commit 6bc17a78a05671d303820224fb37ca339c1dc2cb
	Issue introduced in 2.6.15 with commit 8de98402652c01839ae321be6cb3054cf5735d83 and fixed in 7.1.4 with commit 4bb88aee6b868cbf73bf453f62497802f5fe4769
	Issue introduced in 2.6.15 with commit 8de98402652c01839ae321be6cb3054cf5735d83 and fixed in 7.2-rc3 with commit b9399d25fbb34a05bbe76eeedd730f62ff2670e9

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-64348
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/usb/fotg210/fotg210-hcd.c
	drivers/usb/host/ehci-sched.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/b0d00d077f9738d215af9b50c74dffab7a1de19f
	https://git.kernel.org/stable/c/be5004395dfd0b6ec310db359f887fa396fd0dd2
	https://git.kernel.org/stable/c/8890699eea19027ef6e4f9cbcf27cba5e789793f
	https://git.kernel.org/stable/c/6bc17a78a05671d303820224fb37ca339c1dc2cb
	https://git.kernel.org/stable/c/4bb88aee6b868cbf73bf453f62497802f5fe4769
	https://git.kernel.org/stable/c/b9399d25fbb34a05bbe76eeedd730f62ff2670e9