Executive brief
The Linux kernel's Cypress c67x00 USB controller driver has a use-after-free bug in its isochronous USB request handling code. When processing certain USB data transfers, the driver can attempt to access memory that has already been freed, potentially allowing local attackers to cause system instability or gain elevated privileges.
Technical details
A use-after-free vulnerability exists in c67x00_add_iso_urb() in drivers/usb/c67x00/c67x00-sched.c. When TD (Transfer Descriptor) creation fails for the final packet of an isochronous URB, the driver calls c67x00_giveback_urb() to return the URB before updating endpoint scheduling state. The giveback function frees the URB's private data, and the completion callback may release the final URB reference. Subsequent accesses to urbp->ep_data, urb->interval, and urbp->cnt then operate on freed memory. The fix reorders operations to update next_frame and cnt before the giveback, ensuring the giveback is the last operation. Attack vector is local, requiring code execution on the affected system to interact with USB isochronous transfers.
Affected products
- Linux Linux kernel various versions from 2.6.11 through 7.2 (see Fixes: e9b29ffc519b)
Timeline
- 2026-09-04: disclosed
- 2026-09-02: patched: Patches committed to stable kernel trees