CVE-2026-89622

Received Received - Intake

Use-After-Free in Linux Kernel HID MCP2221 Driver

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: HID: mcp2221: clear rxbuf after I2C/SMBus transfer completes mcp_i2c_smbus_read() stores the caller-supplied buffer pointer in mcp->rxbuf for the duration of a transfer but never clears it when the transfer finishes or times out. Once the caller frees or reuses the buffer, mcp->rxbuf becomes a dangling pointer. A delayed or spurious MCP2221_I2C_GET_DATA report can then drive mcp2221_raw_event() to memcpy device data into the freed memory, causing a write use-after-free. Route all return paths through a single exit point that clears mcp->rxbuf and mcp->rxbuf_size, so that the existing !mcp->rxbuf guard in the raw_event handler can reject any report arriving after the transfer has ended.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-11

Generated

2026-09-12

AI Q&A

2026-09-12

EPSS Evaluated

N/A

NVD

CVE-2026-89622

EUVD

EUVD-2026-76534

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a use-after-free vulnerability in the Linux kernel's HID MCP2221 driver. It occurs when the mcp_i2c_smbus_read function stores a buffer pointer in mcp->rxbuf during I2C/SMBus transfers but fails to clear it afterward. If the buffer is freed or reused, mcp->rxbuf becomes a dangling pointer. A delayed or unexpected MCP2221_I2C_GET_DATA report can then cause the driver to write data into this freed memory, leading to a use-after-free condition.

Detection Guidance

This vulnerability is specific to the Linux kernel's HID MCP2221 driver and does not have network-based detection methods. Detection requires checking the kernel version and verifying if the vulnerable driver code is present. Use commands like 'uname -a' to check the kernel version and 'modinfo mcp2221' to inspect the driver module.

Impact Analysis

This vulnerability could allow an attacker with local access to trigger a use-after-free condition, potentially leading to system crashes, privilege escalation, or arbitrary code execution. Systems using the MCP2221 USB-to-I2C/SMBus bridge with affected Linux kernel versions are at risk.

Mitigation Strategies

Immediately update your Linux kernel to the latest stable version where this vulnerability is patched. If updating is not immediately possible, consider disabling the MCP2221 driver module using 'modprobe -r mcp2221' as a temporary workaround. Ensure your system is rebooted after applying updates.

Hi! I’m here to help you understand CVE-2026-89622. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70