Remote Code Execution Vulnerability in Linux Kernel's USB Media Driver

CVE-2026-64240

What is CVE-2026-64240?

A vulnerability has been identified in the Linux kernel's USB media drivers, specifically involving the igorplugusb driver. A recent change in the control request struct has led to a situation where the USB core misinterprets the setup packet. This occurs due to the driver using an incorrect pointer for the URB setup, potentially causing invalid requests and warnings during operation. Implementing the correct pointer reference can mitigate this issue, ensuring that the control requests are handled properly and reducing the risk of unforeseen system behavior.

References