CVE-2026-64337

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> usb: mtu3: unmap request DMA on queue failure<br /> <br /> mtu3_gadget_queue() maps the request before checking whether<br /> the QMU GPD ring can accept another transfer. the request is<br /> returned with -EAGAIN before it is linked on the endpoint<br /> request list if mtu3_prepare_transfer() fails.<br /> <br /> Normal completion and dequeue paths unmap requests from<br /> mtu3_req_complete(), but this error path never reaches that<br /> helper, so the DMA mapping is left active. Unmap the request<br /> before returning from the failed queue path.