Answer in brief
CVE-2026-64349 records a Unknown severity vulnerability in usb: dwc3: fix dwc3_readl() and dwc3_writel() calls in dwc3_ulpi_setup(). The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=476ee6389120e1900290b46081b3a12b54e05672 <41a4e80d5af04855e68ac88f5e2cd07fa67287f8 || >=9accc68b1cf0a2b220f51d53641128bb32598070 <4349e487a1149ff33b65d53427b8aca57f2e4578 || >=9accc68b1cf0a2b220f51d53641128bb32598070 <e0f844d9d74200d311c6438a0f04270834ba5365 || >=6.18.32 <6.18.40 | 41a4e80d5af04855e68ac88f5e2cd07fa67287f8, 4349e487a1149ff33b65d53427b8aca57f2e4578, e0f844d9d74200d311c6438a0f04270834ba5365, 6.18.40 |
| Linux/Linuxgeneric | 7.0 | Not reported |
Published upstream
Jul 25, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 17, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 11, 2026
In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: fix dwc3_readl() and dwc3_writel() calls in dwc3_ulpi_setup() The dwc3_ulpi_setup() calls the register read and write calls with dwc3->regs when both these calls take the dwc3 structure directly. Chnage these two calls to fix the following sparse warning, and possibly a nasty bug in the dwc3_ulpi_setup() code: drivers/usb/dwc3/core.c:796:45: warning: incorrect type in argument 1 (different address spaces) drivers/usb/dwc3/core.c:796:45: expected struct dwc3 *dwc drivers/usb/dwc3/core.c:796:45: got void [noderef] __iomem *regs drivers/usb/dwc3/core.c:798:40: warning: incorrect type in argument 1 (different address spaces) drivers/usb/dwc3/core.c:798:40: expected struct dwc3 *dwc drivers/usb/dwc3/core.c:798:40: got void [noderef] __iomem *regs
Quoted source text, attributed separately from HOL analysis.
Answer in brief
CVE-2026-64349 records a Unknown severity vulnerability in usb: dwc3: fix dwc3_readl() and dwc3_writel() calls in dwc3_ulpi_setup(). The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=476ee6389120e1900290b46081b3a12b54e05672 <41a4e80d5af04855e68ac88f5e2cd07fa67287f8 || >=9accc68b1cf0a2b220f51d53641128bb32598070 <4349e487a1149ff33b65d53427b8aca57f2e4578 || >=9accc68b1cf0a2b220f51d53641128bb32598070 <e0f844d9d74200d311c6438a0f04270834ba5365 || >=6.18.32 <6.18.40 | 41a4e80d5af04855e68ac88f5e2cd07fa67287f8, 4349e487a1149ff33b65d53427b8aca57f2e4578, e0f844d9d74200d311c6438a0f04270834ba5365, 6.18.40 |
| Linux/Linuxgeneric | 7.0 | Not reported |
Published upstream
Jul 25, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 17, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 11, 2026
In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: fix dwc3_readl() and dwc3_writel() calls in dwc3_ulpi_setup() The dwc3_ulpi_setup() calls the register read and write calls with dwc3->regs when both these calls take the dwc3 structure directly. Chnage these two calls to fix the following sparse warning, and possibly a nasty bug in the dwc3_ulpi_setup() code: drivers/usb/dwc3/core.c:796:45: warning: incorrect type in argument 1 (different address spaces) drivers/usb/dwc3/core.c:796:45: expected struct dwc3 *dwc drivers/usb/dwc3/core.c:796:45: got void [noderef] __iomem *regs drivers/usb/dwc3/core.c:798:40: warning: incorrect type in argument 1 (different address spaces) drivers/usb/dwc3/core.c:798:40: expected struct dwc3 *dwc drivers/usb/dwc3/core.c:798:40: got void [noderef] __iomem *regs
Quoted source text, attributed separately from HOL analysis.