Executive brief
A vulnerability was identified in the Linux kernel's driver for IgorPlug-USB infrared receivers. The driver failed to follow specific memory management rules required for USB devices, which could lead to data corruption or unpredictable system behavior when the device is used with certain hardware controllers. This issue primarily affects systems using these specific USB infrared receivers.
Technical details
A vulnerability in the Linux kernel's 'igorplugusb' driver (drivers/media/rc/igorplugusb.c) stems from the 'usb_ctrlrequest' structure being embedded within the driver's main state structure rather than being allocated separately. On certain host controllers (HCs), USB control requests are subject to Direct Memory Access (DMA), requiring the request structure to be independently allocated to satisfy DMA coherency rules. Failure to do so can result in cache-related memory corruption. The fix involves dynamically allocating the 'usb_ctrlrequest' structure during the probe phase and ensuring it is properly freed during disconnection. This issue is addressed in multiple stable kernel branches.
Affected products
- Linux Linux kernel All versions prior to the fix in the igorplugusb driver
Timeline
- 2026-05-01: other: Initial patch authored by Oliver Neukum
- 2026-05-27: disclosed: CVE published to NVD
References
- https://git.kernel.org/stable/c/0adac0ee2c42027d80bac02ea9b576a88f8955d3
- https://git.kernel.org/stable/c/0be8fcd9005e3d3b5a61fe34b070a9663adbb4dc
- https://git.kernel.org/stable/c/18d6a7c9e4e63c57157e9a57dd9bf3cd38e4c45a
- https://git.kernel.org/stable/c/a62ca67e3c72fb297dc7c86495ba8f7329d7f150
- https://git.kernel.org/stable/c/eac69475b01fe1e861dfe3960b57fa95671c132e