CVE-2026-64454 Linux CVE debrief

Who should care

Defenders responsible for Linux kernel security, particularly those managing systems with the USB DWC3 driver, should review and apply the patch to ensure the fix is implemented. They should also verify the patch implementation to prevent potential Lockdep warnings and review system configurations to ensure the USB DWC3 driver is properly secured.

Why it matters

The vulnerability in the Linux kernel's USB DWC3 driver may cause Lockdep warnings if not properly patched. Defenders should prioritize reviewing and applying the patch.

• Verify patch implementation to prevent potential Lockdep warnings
• Review system configurations to ensure the USB DWC3 driver is properly secured

Technical summary

The Linux kernel's USB DWC3 driver has a vulnerability that triggers a Lockdep warning when the gadget ->disconnect() callback is called with IRQs disabled. The issue arises from dwc3_gadget_suspend() taking dwc->lock with IRQs disabled and then calling dwc3_disconnect_gadget(). The fix involves adding a sleepable suspend-side wrapper that snapshots the disconnect callback under dwc->lock and runs it after spin_unlock_irqrestore(). This change ensures that the callback is executed in a sleepable context, preventing the Lockdep warning.

Defensive priority

Defenders should prioritize reviewing and applying the patch to ensure the fix is implemented, as the vulnerability is in the Linux kernel's USB DWC3 driver.

Recommended defensive actions

• Review and apply the patch to the Linux kernel's USB DWC3 driver
• Verify the fix is implemented in the Linux kernel
• Monitor for any potential issues related to the USB DWC3 driver
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The issue was identified by a static analysis tool and manually reviewed against the current Linux kernel tree. The problem arises from dwc3_gadget_suspend() taking dwc->lock with IRQs disabled and then calling dwc3_disconnect_gadget(), which in turn calls the gadget ->disconnect() callback with IRQs still disabled. This triggers a Lockdep warning because the callback may contain sleepable operations. The fix involves adding a sleepable suspend-side wrapper that snapshots the disconnect callback under dwc->lock and runs it after spin_

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.