Cloudanix VulnDB

CVE-2026-80826

None

CVSS

—

EPSS

0.2%

Published

Sep 4, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in the Linux kernel's handling of certain USB data transfers can let an attacker crash the computer or potentially run harmful code.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Moderate
Impact
Privilege Gain
Component
OS kernel
Class
Use After Free
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Use-after-free in c67x00_add_iso_urb() where the URB and its private data are given back (triggering free via c67x00_giveback_urb and possible final reference drop in the completion callback) before the code finishes accessing urbp->ep_data, urb->interval, and urbp->cnt.

Why it matters to the business

Systems using the affected USB controller driver can experience kernel crashes or memory corruption; the low EPSS and lack of KEV listing indicate limited immediate operational risk but still require patching on any Linux hosts exposing the driver.

How an attack unfolds

An attacker with the ability to submit crafted isochronous URBs to the c67x00 controller triggers a TD allocation failure on the final packet; this causes the function to give the URB back early, after which the now-freed private data structures are dereferenced, leading to a use-after-free condition that may be leveraged for kernel code execution or denial of service.

How to fix it

Apply the upstream kernel patch that moves the next_frame and cnt updates before the giveback call; rebuild and deploy the fixed kernel on all affected systems.

How to confirm the fix worked

Confirm the presence of the fix by inspecting the c67x00_add_iso_urb function to ensure giveback occurs only after all field updates; test with synthetic isochronous URB failure cases to verify no post-giveback accesses occur.

Typical attack path

  1. Obtain local access or ability to submit USB requests to a system using the c67x00 driver
  2. Submit a specially crafted isochronous URB that causes TD creation to fail on the last packet
  3. Trigger the early giveback path in c67x00_add_iso_urb()
  4. Reuse or corrupt the freed URB private data during the subsequent field accesses

How to detect it

Review kernel logs for oops or panic messages referencing c67x00_add_iso_urb, c67x00_giveback_urb, or use-after-free patterns involving URB private data; correlate with USB isochronous transfer activity.

What your security team should do

  • Prioritize kernel updates on any systems exposing the c67x00 USB driver
  • Monitor EPSS and KEV feeds for changes given the 25-day publication window
  • Restrict unprivileged USB device access where possible until patches are applied

The record

In the Linux kernel, the following vulnerability has been resolved: USB: c67x00: fix use-after-free in c67x00_add_iso_urb() When TD creation fails for the last packet of an isochronous URB, c67x00_add_iso_urb() gives the URB back before updating the endpoint scheduling state. c67x00_giveback_urb() frees the URB private data, and the completion callback may release the final URB reference. The following accesses to urbp->ep_data, urb->interval, and urbp->cnt can therefore use freed memory. Update next_frame and cnt before giving back the failed final packet, making the giveback the last operation that uses the URB and its private data.

Affected packages

Ecosystem Package Introduced Fixed