Executive brief
A vulnerability was identified in the Linux kernel's driver for IgorPlug-USB infrared receivers. Due to a coding error in how the driver communicates with the USB hardware, the system may misinterpret internal memory addresses as device commands. While primarily a stability issue that could cause system warnings or driver failure, it represents a technical flaw in how the operating system handles specific USB media hardware.
Technical details
A regression was introduced in the igorplugusb driver when the control request storage was changed from an embedded structure to an allocated pointer to satisfy DMA coherency rules. The driver continued to pass the address of the pointer (&ir->request) instead of the pointer itself to usb_fill_control_urb(). Consequently, the USB core interprets the raw pointer bytes as a usb_ctrlrequest setup packet. This results in invalid bRequestType values and triggers 'BOGUS control dir' warnings. The fix ensures the allocated memory address is passed correctly. This affects the media/rc subsystem and has been patched across multiple stable kernel branches.
Affected products
- Linux Linux 6.6.140 to 6.6.143
Timeline
- 2026-05-20: disclosed: Initial patch submitted by developer
- 2026-07-24: advisory: CVE-2026-64240 published
References
- https://git.kernel.org/stable/c/060fca8e098387f949e4eedaf215d952e477ac12
- https://git.kernel.org/stable/c/0d880d2db9856e94127ab09331363bef59f98005
- https://git.kernel.org/stable/c/171022c7d594c133a45f92357a2a91475edabe20
- https://git.kernel.org/stable/c/2243ad78ce64d344754260533ae7730c2174a34a
- https://git.kernel.org/stable/c/5cc3f6db72f77d1a8f7f1cf4ac01803927ffdf15
- https://git.kernel.org/stable/c/aa22590a16e51455c6db802c774b31aadc604a9a
- https://git.kernel.org/stable/c/e823e4294511989f5962e7ad85bf4d179ba74f52