{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-64240","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2026-07-19T15:36:31.772Z","datePublished":"2026-07-24T15:27:43.590Z","dateUpdated":"2026-07-24T15:27:43.590Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-07-24T15:27:43.590Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: rc: igorplugusb: fix control request setup packet\n\nCommit eac69475b01f (\"media: rc: igorplugusb: heed coherency\nrules\") changed the control request storage from an embedded struct to\nan allocated pointer so it can obey DMA coherency rules.\n\nHowever, the driver still passes &ir->request to usb_fill_control_urb().\nThat points the URB setup packet at the pointer field itself rather than\nat the allocated struct usb_ctrlrequest.\n\nUSB core then interprets pointer bytes as the setup packet. This can\nproduce an invalid bRequestType and trigger the control direction warning\nreported by syzbot:\n\n  usb 2-1: BOGUS control dir, pipe 80003580 doesn't match bRequestType 0\n\nPass ir->request itself as the setup packet."}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/media/rc/igorplugusb.c"],"versions":[{"version":"bc04b8633b375af6ac8a8bb615258b80fe06cdaa","lessThan":"e823e4294511989f5962e7ad85bf4d179ba74f52","status":"affected","versionType":"git"},{"version":"81f0fb813e4bf28b3ca28dc218938a32eb48f740","lessThan":"2243ad78ce64d344754260533ae7730c2174a34a","status":"affected","versionType":"git"},{"version":"0e84aa8fc23c7578f105e3a2160f9d0aa2bed79a","lessThan":"aa22590a16e51455c6db802c774b31aadc604a9a","status":"affected","versionType":"git"},{"version":"18d6a7c9e4e63c57157e9a57dd9bf3cd38e4c45a","lessThan":"060fca8e098387f949e4eedaf215d952e477ac12","status":"affected","versionType":"git"},{"version":"0be8fcd9005e3d3b5a61fe34b070a9663adbb4dc","lessThan":"0d880d2db9856e94127ab09331363bef59f98005","status":"affected","versionType":"git"},{"version":"0adac0ee2c42027d80bac02ea9b576a88f8955d3","lessThan":"f33b5a61673bd220fdaaf4202cf1013d6d66c943","status":"affected","versionType":"git"},{"version":"a62ca67e3c72fb297dc7c86495ba8f7329d7f150","lessThan":"5cc3f6db72f77d1a8f7f1cf4ac01803927ffdf15","status":"affected","versionType":"git"},{"version":"eac69475b01fe1e861dfe3960b57fa95671c132e","lessThan":"171022c7d594c133a45f92357a2a91475edabe20","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/media/rc/igorplugusb.c"],"versions":[{"version":"6.6.140","lessThan":"6.6.143","status":"affected","versionType":"semver"},{"version":"6.12.86","lessThan":"6.12.93","status":"affected","versionType":"semver"},{"version":"6.18.27","lessThan":"6.18.35","status":"affected","versionType":"semver"},{"version":"7.0.4","lessThan":"7.0.12","status":"affected","versionType":"semver"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.6.140","versionEndExcluding":"6.6.143"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.12.86","versionEndExcluding":"6.12.93"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.18.27","versionEndExcluding":"6.18.35"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"7.0.4","versionEndExcluding":"7.0.12"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/e823e4294511989f5962e7ad85bf4d179ba74f52"},{"url":"https://git.kernel.org/stable/c/2243ad78ce64d344754260533ae7730c2174a34a"},{"url":"https://git.kernel.org/stable/c/aa22590a16e51455c6db802c774b31aadc604a9a"},{"url":"https://git.kernel.org/stable/c/060fca8e098387f949e4eedaf215d952e477ac12"},{"url":"https://git.kernel.org/stable/c/0d880d2db9856e94127ab09331363bef59f98005"},{"url":"https://git.kernel.org/stable/c/f33b5a61673bd220fdaaf4202cf1013d6d66c943"},{"url":"https://git.kernel.org/stable/c/5cc3f6db72f77d1a8f7f1cf4ac01803927ffdf15"},{"url":"https://git.kernel.org/stable/c/171022c7d594c133a45f92357a2a91475edabe20"}],"title":"media: rc: igorplugusb: fix control request setup packet","x_generator":{"engine":"bippy-1.2.0"}}}}