CVE-2026-64240

media: rc: igorplugusb: fix control request setup packet

MEDIUM

5.5

CVSS Score

Published: July 24, 2026 at 03:27 PM UTC

Updated: August 13, 2026 at 05:37 PM UTC

1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM5.5

Exploit prediction

EPSS 0.1%

Description

In the Linux kernel, the following vulnerability has been resolved: media: rc: igorplugusb: fix control request setup packet Commit eac69475b01f ("media: rc: igorplugusb: heed coherency rules") changed the control request storage from an embedded struct to an allocated pointer so it can obey DMA coherency rules. However, the driver still passes &ir->request to usb_fill_control_urb(). That points the URB setup packet at the pointer field itself rather than at the allocated struct usb_ctrlrequest. USB core then interprets pointer bytes as the setup packet. This can produce an invalid bRequestType and trigger the control direction warning reported by syzbot: usb 2-1: BOGUS control dir, pipe 80003580 doesn't match bRequestType 0 Pass ir->request itself as the setup packet.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Linux Kernel · Linux

95%

6.12.86 ≤ v < 6.12.936.18.27 ≤ v < 6.18.356.6.140 ≤ v < 6.6.1437.0.4 ≤ v < 7.0.120adac0ee2c42027d80bac02ea9b576a88f8955d30be8fcd9005e3d3b5a61fe34b070a9663adbb4dc0e84aa8fc23c7578f105e3a2160f9d0aa2bed79a18d6a7c9e4e63c57157e9a57dd9bf3cd38e4c45a6.12.86 6.18.27 6.6.140 7.0.4 7.1 rc1 7.1 rc2 7.1 rc3 7.1 rc4 7.1 rc581f0fb813e4bf28b3ca28dc218938a32eb48f740a62ca67e3c72fb297dc7c86495ba8f7329d7f150bc04b8633b375af6ac8a8bb615258b80fe06cdaaeac69475b01fe1e861dfe3960b57fa95671c132e

Vendor states this is fixed in 060fca8e098387f949e4eedaf215d952e477ac12 (fixed)

Vendor states this is fixed in 0d880d2db9856e94127ab09331363bef59f98005 (fixed)

Vendor states this is fixed in 171022c7d594c133a45f92357a2a91475edabe20 (fixed)

Vendor states this is fixed in 2243ad78ce64d344754260533ae7730c2174a34a (fixed)

Vendor states this is fixed in 5cc3f6db72f77d1a8f7f1cf4ac01803927ffdf15 (fixed)

Vendor states this is fixed in aa22590a16e51455c6db802c774b31aadc604a9a (fixed)

Vendor states this is fixed in e823e4294511989f5962e7ad85bf4d179ba74f52 (fixed)

Vendor states this is fixed in f33b5a61673bd220fdaaf4202cf1013d6d66c943 (fixed)

Affected range stops below 6.12.93, so it looks safe — our inference, not a vendor statement

Affected range stops below 6.18.35, so it looks safe — our inference, not a vendor statement

Affected range stops below 6.6.143, so it looks safe — our inference, not a vendor statement

Affected range stops below 7.0.12, so it looks safe — our inference, not a vendor statement