{"affected":[{"conditional":false,"product":"linux_kernel","source":"NVD","vendor":"linux","versions":[{"greaterThanOrEqual":"6.16","lessThan":"6.18.39","status":"affected","version":"*","versionType":"custom"}]},{"conditional":false,"product":"linux_kernel","source":"NVD","vendor":"linux","versions":[{"greaterThanOrEqual":"6.19","lessThan":"7.1.4","status":"affected","version":"*","versionType":"custom"}]},{"conditional":false,"product":"linux_kernel","source":"NVD","vendor":"linux","versions":[{"status":"affected","version":"7.2","versionType":"custom"}]}],"cpeConfigurations":[{"negate":false,"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.18.39","versionStartIncluding":"6.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.1.4","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.2:rc1:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.2:rc2:*:*:*:*:*:*","vulnerable":true}],"negate":false,"operator":"OR"}],"operator":"OR"}],"cveId":"CVE-2026-64464","cwes":["CWE-401"],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nxhci: sideband: fix ring sg table pages leak\n\nxhci_ring_to_sgtable() allocates a temporary pages array and\nuses it to build the returned sg_table with\nsg_alloc_table_from_pages().\n\nThe error paths free the pages array, but the success path\nreturns the sg_table without freeing it. This leaks the temporary\narray every time a sideband client gets an endpoint or event ring\nbuffer.\n\nFree the pages array after sg_alloc_table_from_pages() succeeds.\nThe returned sg_table has its own scatterlist entries and does not\ndepend on the temporary array after construction.","epss":{"date":"2026-11-10","percentile":0.10785,"score":0.00206},"exploits":[],"kev":null,"metrics":[{"score":5.5,"severity":"medium","source":"NVD: nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"}],"modifiedAt":1794505862393,"publishedAt":1784974651660,"references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/49f6e3c3ef19f04f6657ed8dce550e36c763abb8"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/99d00a9e35e311a91d258029d5bb584377296c34"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a3eaf82ff842d6ca95937ea584417e04828235a6"}],"remediation":[{"kind":"fix","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://git.kernel.org/stable/c/49f6e3c3ef19f04f6657ed8dce550e36c763abb8"},{"kind":"fix","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://git.kernel.org/stable/c/99d00a9e35e311a91d258029d5bb584377296c34"},{"kind":"fix","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://git.kernel.org/stable/c/a3eaf82ff842d6ca95937ea584417e04828235a6"}],"revision":"94c2ce45fe1492e0e83a097a3a82bb995aa48af13bd0781f8c6ff436e1e2a3c6","sources":[{"modifiedAt":1794505862393,"name":"NVD","retrievedAt":1794507347938,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64464"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1794462706169,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-64464"}],"ssvc":null,"status":"published","title":"CVE-2026-64464","updatedAt":1794507347938}