{"id":"CVE-2026-64240","state":"PUBLISHED","title":"media: rc: igorplugusb: fix control request setup packet","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: rc: igorplugusb: fix control request setup packet\n\nCommit eac69475b01f (\"media: rc: igorplugusb: heed coherency\nrules\") changed the control request storage from an embedded struct to\nan allocated pointer so it can obey DMA coherency rules.\n\nHowever, the driver still passes &ir->request to usb_fill_control_urb().\nThat points the URB setup packet at the pointer field itself rather than\nat the allocated struct usb_ctrlrequest.\n\nUSB core then interprets pointer bytes as the setup packet. This can\nproduce an invalid bRequestType and trigger the control direction warning\nreported by syzbot:\n\n  usb 2-1: BOGUS control dir, pipe 80003580 doesn't match bRequestType 0\n\nPass ir->request itself as the setup packet.","publishedAt":"2026-07-24T15:27:43.590Z","updatedAt":"2026-07-24T15:27:43.590Z","severity":null,"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"bc04b8633b375af6ac8a8bb615258b80fe06cdaa","status":"affected","lessThan":"e823e4294511989f5962e7ad85bf4d179ba74f52","versionType":"git"},{"version":"81f0fb813e4bf28b3ca28dc218938a32eb48f740","status":"affected","lessThan":"2243ad78ce64d344754260533ae7730c2174a34a","versionType":"git"},{"version":"0e84aa8fc23c7578f105e3a2160f9d0aa2bed79a","status":"affected","lessThan":"aa22590a16e51455c6db802c774b31aadc604a9a","versionType":"git"},{"version":"18d6a7c9e4e63c57157e9a57dd9bf3cd38e4c45a","status":"affected","lessThan":"060fca8e098387f949e4eedaf215d952e477ac12","versionType":"git"},{"version":"0be8fcd9005e3d3b5a61fe34b070a9663adbb4dc","status":"affected","lessThan":"0d880d2db9856e94127ab09331363bef59f98005","versionType":"git"},{"version":"0adac0ee2c42027d80bac02ea9b576a88f8955d3","status":"affected","lessThan":"f33b5a61673bd220fdaaf4202cf1013d6d66c943","versionType":"git"},{"version":"a62ca67e3c72fb297dc7c86495ba8f7329d7f150","status":"affected","lessThan":"5cc3f6db72f77d1a8f7f1cf4ac01803927ffdf15","versionType":"git"},{"version":"eac69475b01fe1e861dfe3960b57fa95671c132e","status":"affected","lessThan":"171022c7d594c133a45f92357a2a91475edabe20","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/media/rc/igorplugusb.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"6.6.140","status":"affected","lessThan":"6.6.143","versionType":"semver"},{"version":"6.12.86","status":"affected","lessThan":"6.12.93","versionType":"semver"},{"version":"6.18.27","status":"affected","lessThan":"6.18.35","versionType":"semver"},{"version":"7.0.4","status":"affected","lessThan":"7.0.12","versionType":"semver"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/media/rc/igorplugusb.c"]}],"references":["https://git.kernel.org/stable/c/e823e4294511989f5962e7ad85bf4d179ba74f52","https://git.kernel.org/stable/c/2243ad78ce64d344754260533ae7730c2174a34a","https://git.kernel.org/stable/c/aa22590a16e51455c6db802c774b31aadc604a9a","https://git.kernel.org/stable/c/060fca8e098387f949e4eedaf215d952e477ac12","https://git.kernel.org/stable/c/0d880d2db9856e94127ab09331363bef59f98005","https://git.kernel.org/stable/c/f33b5a61673bd220fdaaf4202cf1013d6d66c943","https://git.kernel.org/stable/c/5cc3f6db72f77d1a8f7f1cf4ac01803927ffdf15","https://git.kernel.org/stable/c/171022c7d594c133a45f92357a2a91475edabe20"],"weaknesses":[],"ingestedAt":"2026-10-29T20:12:41.951Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/64xxx/CVE-2026-64240.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-64240","state":"PUBLISHED","datePublished":"2026-07-24T15:27:43.590Z","dateUpdated":"2026-07-24T15:27:43.590Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-07-19T15:36:31.772Z"},"containers":{"cna":{"title":"media: rc: igorplugusb: fix control request setup packet","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: rc: igorplugusb: fix control request setup packet\n\nCommit eac69475b01f (\"media: rc: igorplugusb: heed coherency\nrules\") changed the control request storage from an embedded struct to\nan allocated pointer so it can obey DMA coherency rules.\n\nHowever, the driver still passes &ir->request to usb_fill_control_urb().\nThat points the URB setup packet at the pointer field itself rather than\nat the allocated struct usb_ctrlrequest.\n\nUSB core then interprets pointer bytes as the setup packet. This can\nproduce an invalid bRequestType and trigger the control direction warning\nreported by syzbot:\n\n  usb 2-1: BOGUS control dir, pipe 80003580 doesn't match bRequestType 0\n\nPass ir->request itself as the setup packet."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"bc04b8633b375af6ac8a8bb615258b80fe06cdaa","status":"affected","lessThan":"e823e4294511989f5962e7ad85bf4d179ba74f52","versionType":"git"},{"version":"81f0fb813e4bf28b3ca28dc218938a32eb48f740","status":"affected","lessThan":"2243ad78ce64d344754260533ae7730c2174a34a","versionType":"git"},{"version":"0e84aa8fc23c7578f105e3a2160f9d0aa2bed79a","status":"affected","lessThan":"aa22590a16e51455c6db802c774b31aadc604a9a","versionType":"git"},{"version":"18d6a7c9e4e63c57157e9a57dd9bf3cd38e4c45a","status":"affected","lessThan":"060fca8e098387f949e4eedaf215d952e477ac12","versionType":"git"},{"version":"0be8fcd9005e3d3b5a61fe34b070a9663adbb4dc","status":"affected","lessThan":"0d880d2db9856e94127ab09331363bef59f98005","versionType":"git"},{"version":"0adac0ee2c42027d80bac02ea9b576a88f8955d3","status":"affected","lessThan":"f33b5a61673bd220fdaaf4202cf1013d6d66c943","versionType":"git"},{"version":"a62ca67e3c72fb297dc7c86495ba8f7329d7f150","status":"affected","lessThan":"5cc3f6db72f77d1a8f7f1cf4ac01803927ffdf15","versionType":"git"},{"version":"eac69475b01fe1e861dfe3960b57fa95671c132e","status":"affected","lessThan":"171022c7d594c133a45f92357a2a91475edabe20","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/media/rc/igorplugusb.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"6.6.140","status":"affected","lessThan":"6.6.143","versionType":"semver"},{"version":"6.12.86","status":"affected","lessThan":"6.12.93","versionType":"semver"},{"version":"6.18.27","status":"affected","lessThan":"6.18.35","versionType":"semver"},{"version":"7.0.4","status":"affected","lessThan":"7.0.12","versionType":"semver"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/media/rc/igorplugusb.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/e823e4294511989f5962e7ad85bf4d179ba74f52"},{"url":"https://git.kernel.org/stable/c/2243ad78ce64d344754260533ae7730c2174a34a"},{"url":"https://git.kernel.org/stable/c/aa22590a16e51455c6db802c774b31aadc604a9a"},{"url":"https://git.kernel.org/stable/c/060fca8e098387f949e4eedaf215d952e477ac12"},{"url":"https://git.kernel.org/stable/c/0d880d2db9856e94127ab09331363bef59f98005"},{"url":"https://git.kernel.org/stable/c/f33b5a61673bd220fdaaf4202cf1013d6d66c943"},{"url":"https://git.kernel.org/stable/c/5cc3f6db72f77d1a8f7f1cf4ac01803927ffdf15"},{"url":"https://git.kernel.org/stable/c/171022c7d594c133a45f92357a2a91475edabe20"}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-07-24T15:27:43.590Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.6.140","versionEndExcluding":"6.6.143"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.12.86","versionEndExcluding":"6.12.93"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.18.27","versionEndExcluding":"6.18.35"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"7.0.4","versionEndExcluding":"7.0.12"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}}}}}