CVE-2026-63927

A flaw was found in the Linux kernel, specifically within the dwc2 USB driver. This vulnerability, known as a use-after-free, occurs when the system attempts to access memory that has already been released. This happens because a USB Request Block (urb) is incorrectly accessed after it has been returned. A local attacker could potentially exploit this issue to cause the system to crash (denial of service) or potentially gain unauthorized access or control.

This vulnerability is rated as Moderate because successful exploitation requires local privileges and is restricted to systems utilizing DesignWare USB2 controller hardware, primarily resulting in a denial of service via a kernel crash. Typical Red Hat Enterprise Linux server and cloud deployments do not operate this specific USB hardware controller, significantly reducing real-world exposure. Furthermore, the vulnerable code is not present in Red Hat Enterprise Linux 7, 8, and 9, limiting potential impact to newer environments such as RHEL 10 and Red Hat In-Vehicle OS.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.