Cloudanix VulnDB

CVE-2026-80824

None

CVSS

—

EPSS

0.2%

Published

Sep 4, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in the Linux kernel's handling of USB devices can let ordinary users crash the whole system or possibly take control of it.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Low
Impact
Privilege Gain
Component
OS kernel
Class
Use After Free
Remediation
Patch
Effort
Low
Patch risk
Low

What it actually does

Use-after-free in Linux kernel usbfs: usbdev_release drops its usb_device reference before draining async URBs, so free_async calls dec_usb_memory_use_count which dereferences freed memory via bus_to_hcd on a now-invalid struct usb_device.

Why it matters to the business

Local unprivileged users on Linux systems can trigger kernel crashes or potential code execution via USB device nodes, risking denial of service, data corruption, or escalation to root on multi-user or shared systems.

How an attack unfolds

An attacker opens a /dev/bus/usb node, mmaps a buffer, submits an URB whose buffer lies in the mapping, waits for device unplug (or forces disconnect), then unmaps and closes; the delayed usbdev_release path always hits the freeing branch of dec_usb_memory_use_count because the MAP_SHARED vma holds the file reference until the end.

How to fix it

Upgrade the Linux kernel to a version containing the fix that moves usb_put_dev after the async URB drain loop in usbdev_release; rebuild and reboot with the patched kernel.

How to confirm the fix worked

Confirm the source change in usbdev_release (usb_put_dev after drain) or verify the kernel build contains the corrected usbdev_release+0x375 path; attempt the published reproducer and ensure no KASAN slab-use-after-free is reported.

Typical attack path

  1. Obtain read/write access to a /dev/bus/usb device node
  2. mmap the file descriptor to create a shared buffer
  3. Submit an URB referencing that buffer
  4. Trigger or wait for device disconnect
  5. munmap and close the fd to invoke usbdev_release on the freed object

How to detect it

Search kernel logs and dmesg for KASAN slab-use-after-free reports naming dec_usb_memory_use_count, free_async, and usbdev_release; correlate with processes closing USB device file descriptors shortly before crashes.

  • BUG: KASAN: slab-use-after-free in dec_usb_memory_use_count
  • dec_usb_memory_use_count+0x3ae/0x410
  • free_async+0x2aa/0x4f0
  • usbdev_release+0x375/0x460
  • Read of size 8 at addr .* by task .*
  • Allocated by task .* usb_alloc_dev
  • Freed by task .* kfree .* usb_put_dev

What your security team should do

  • Prioritize kernel updates on all systems exposing /dev/bus/usb to unprivileged users
  • Restrict permissions on /dev/bus/usb nodes via udev or device ACLs
  • Enable KASAN or similar memory debugging in test kernels to catch similar UAFs early

The record

In the Linux kernel, the following vulnerability has been resolved: usb: usbfs: fix use-after-free of usb_device in usbdev_release() usbdev_release() drops its reference to the struct usb_device before draining the list of completed async URBs, but that drain path reads back through the same object: free_async() calls dec_usb_memory_use_count() for any URB whose buffer came from the usbfs mmap() region, and its first statement is bus_to_hcd(ps->dev->bus). After a disconnect the usbfs reference can be the last one, in which case usb_put_dev() frees the device and the subsequent loop reads offset 80 of freed memory and uses the result as a struct usb_hcd *, which hcd_buffer_free_pages() then dereferences. This is reachable by an unprivileged process that has read/write access to a /dev/bus/usb node: mmap() the fd, submit one URB with a buffer inside the mapping, wait for the device to be unplugged, then munmap() and close(). It reproduces on every attempt rather than being a race, because a live MAP_SHARED vma holds a reference on the struct file, so usbdev_release() cannot run until the last vma is gone and the freeing branch of dec_usb_memory_use_count() is always taken. BUG: KASAN: slab-use-after-free in dec_usb_memory_use_count+0x3ae/0x410 Read of size 8 at addr ffff8880122ee050 by task poc/769 CPU: 1 UID: 1000 PID: 769 Comm: poc Tainted: G B 6.12.94 #3 Call Trace: dec_usb_memory_use_count+0x3ae/0x410 free_async+0x2aa/0x4f0 usbdev_release+0x375/0x460 __fput+0x3ea/0xb50 __x64_sys_close+0x86/0x100 Allocated by task 11: usb_alloc_dev+0x55/0xd90 hub_event+0x2524/0x43d0 Freed by task 769: kfree+0x121/0x360 device_release+0xd2/0x280 usb_put_dev+0x23/0x30 usbdev_release+0x2d8/0x460 Release the device reference after the drain loop instead. Nothing between the two points requires it to have been dropped.

Affected packages

Ecosystem Package Introduced Fixed