CVE-2026-80826
Received Received - Intake

Use-After-Free in Linux Kernel USB c67x00 Driver

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: USB: c67x00: fix use-after-free in c67x00_add_iso_urb() When TD creation fails for the last packet of an isochronous URB, c67x00_add_iso_urb() gives the URB back before updating the endpoint scheduling state. c67x00_giveback_urb() frees the URB private data, and the completion callback may release the final URB reference. The following accesses to urbp->ep_data, urb->interval, and urbp->cnt can therefore use freed memory. Update next_frame and cnt before giving back the failed final packet, making the giveback the last operation that uses the URB and its private data.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-04
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-80826
EUVD
EUVD-2026-71276

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a use-after-free vulnerability in the Linux kernel's c67x00 USB driver. When handling isochronous URBs (USB Request Blocks), if TD creation fails for the last packet, the function c67x00_add_iso_urb() returns the URB before updating endpoint scheduling state. This leads to accessing freed memory in c67x00_giveback_urb() when the completion callback releases the final URB reference.

Detection Guidance

This vulnerability is specific to the Linux kernel's c67x00 USB driver and involves a use-after-free condition in isochronous URB handling. Detection requires checking kernel logs for related errors or kernel crashes involving the c67x00 driver. Commands like dmesg | grep c67x00 or journalctl -k | grep c67x00 may reveal issues. Ensure your kernel version is up-to-date to avoid this vulnerability.

Impact Analysis

This vulnerability could cause system crashes, memory corruption, or potential privilege escalation if exploited. Systems using affected c67x00 USB devices may experience instability or security breaches due to memory access issues.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it is a low-level kernel memory corruption issue in USB handling. Standards like GDPR and HIPAA focus on data protection and privacy, while this CVE involves a use-after-free bug in USB driver code that could lead to system instability or crashes rather than data breaches or privacy violations.

Mitigation Strategies

Immediate mitigation involves updating the Linux kernel to a patched version that includes the fix for this vulnerability. Check your distribution's security advisories or kernel updates. If updating is not immediately possible, consider disabling the c67x00 USB driver if it is not required, using kernel module blacklisting.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-80826. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart