Executive brief
A vulnerability exists in the Linux kernel's driver for IOWarrior USB devices. When one of these devices is unplugged while data is still being written, the system may attempt to access memory that has already been freed. This can lead to a system crash or unpredictable behavior, potentially impacting the stability of industrial or specialized hardware setups using these USB interfaces.
Technical details
A use-after-free vulnerability was identified in drivers/usb/misc/iowarrior.c in the Linux kernel. The root cause is that submitted write USB Request Blocks (URBs) were not being stopped during the close() operation. Consequently, if a device is disconnected, these URBs could trigger a completion handler that attempts to access the device structure after it has been deallocated. An attacker with physical access to the device could potentially trigger this race condition by disconnecting the device during active write operations. The fix involves unconditionally killing anchored URBs during the disconnect() sequence to ensure no asynchronous handlers run after the device context is destroyed. Patches have been released across multiple stable kernel branches.
Affected products
- Linux Linux Kernel 2.6.21 to 6.6.145
Timeline
- 2026-05-23: patched: Initial patch authored by Johan Hovold
- 2026-07-25: disclosed: CVE published via kernel.org and NVD
References
- https://git.kernel.org/stable/c/164398601a7f160bc3df1efa454f983302cef03f
- https://git.kernel.org/stable/c/97ad9337127be04ca0b027c2b01e69302353f404
- https://git.kernel.org/stable/c/a7bbe946ca3a6eeb6f364d5e84b05e02c7c0d595
- https://git.kernel.org/stable/c/b748f97aff339e7f08dca9cf38a05b980fb66fea
- https://git.kernel.org/stable/c/bc0e4f16c44e50daa0b1ea729934baa3b4815dee
- https://git.kernel.org/stable/c/d058d377291567b72aea33b017215cbfb383b0ad
- https://git.kernel.org/stable/c/e4596816984efc537e7c04c1af0c639394f967f7