CVE-2026-80826

USB: c67x00: fix use-after-free in c67x00_add_iso_urb()

Published Sep 4, 2026 CVSS n/a EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

USB: c67x00: fix use-after-free in c67x00_add_iso_urb()

When TD creation fails for the last packet of an isochronous URB,
c67x00_add_iso_urb() gives the URB back before updating the endpoint
scheduling state.

c67x00_giveback_urb() frees the URB private data, and the completion
callback may release the final URB reference. The following accesses to
urbp->ep_data, urb->interval, and urbp->cnt can therefore use freed
memory.

Update next_frame and cnt before giving back the failed final packet,
making the giveback the last operation that uses the URB and its private
data.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`e9b29ffc519b9e63d4e1c0b1278bb951bb418a9d`	affected	< e4039e9bebb528dd9cd7ac72aeaec529c26c355a
`e9b29ffc519b9e63d4e1c0b1278bb951bb418a9d`	affected	< ade18b4ce78a16558f4f435aece80082f6f7b64c
`e9b29ffc519b9e63d4e1c0b1278bb951bb418a9d`	affected	< bb572801290e25ec1c4753d14af35777303f5d6b
`e9b29ffc519b9e63d4e1c0b1278bb951bb418a9d`	affected	< 62cd519ab74cac499036cd88c11692f8f0d53e14
`e9b29ffc519b9e63d4e1c0b1278bb951bb418a9d`	affected	< ff172092cba7ec990ecc7b610ce703e19570b8f0
`e9b29ffc519b9e63d4e1c0b1278bb951bb418a9d`	affected	< b4cb8081cf80f82e48fbe9c021a8f6d0fa2ed421
`e9b29ffc519b9e63d4e1c0b1278bb951bb418a9d`	affected	< 7983daa159981fac125db2457437723f38ea1472
`e9b29ffc519b9e63d4e1c0b1278bb951bb418a9d`	affected	< f24dcc61bd0ecf7639fac5bf700450b398d793a7
`e9b29ffc519b9e63d4e1c0b1278bb951bb418a9d`	affected	< b1e24de475bf2d66fffc9103f3444b783527d55a

Linux

affected

Version	Status	Constraints
`2.6.26`	affected	—
`0`	unaffected	< 2.6.26
`5.10.269`	unaffected	≤ 5.10.*
`5.15.220`	unaffected	≤ 5.15.*
`6.1.187`	unaffected	≤ 6.1.*
`6.6.156`	unaffected	≤ 6.6.*
`6.12.108`	unaffected	≤ 6.12.*
`6.18.49`	unaffected	≤ 6.18.*
`7.1.13`	unaffected	≤ 7.1.*
`7.2.3`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[e9b29ffc519b9e63d4e1c0b1278bb951bb418a9d,e4039e9bebb528dd9cd7ac72aeaec529c26c355a)`	affected	code_commit	—
`[e9b29ffc519b9e63d4e1c0b1278bb951bb418a9d,ade18b4ce78a16558f4f435aece80082f6f7b64c)`	affected	code_commit	—
`[e9b29ffc519b9e63d4e1c0b1278bb951bb418a9d,bb572801290e25ec1c4753d14af35777303f5d6b)`	affected	code_commit	—
`[e9b29ffc519b9e63d4e1c0b1278bb951bb418a9d,62cd519ab74cac499036cd88c11692f8f0d53e14)`	affected	code_commit	—
`[e9b29ffc519b9e63d4e1c0b1278bb951bb418a9d,ff172092cba7ec990ecc7b610ce703e19570b8f0)`	affected	code_commit	—
`[e9b29ffc519b9e63d4e1c0b1278bb951bb418a9d,b4cb8081cf80f82e48fbe9c021a8f6d0fa2ed421)`	affected	code_commit	—
`[e9b29ffc519b9e63d4e1c0b1278bb951bb418a9d,7983daa159981fac125db2457437723f38ea1472)`	affected	code_commit	—
`[e9b29ffc519b9e63d4e1c0b1278bb951bb418a9d,f24dcc61bd0ecf7639fac5bf700450b398d793a7)`	affected	code_commit	—
`[e9b29ffc519b9e63d4e1c0b1278bb951bb418a9d,b1e24de475bf2d66fffc9103f3444b783527d55a)`	affected	code_commit	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`2.6.26`	affected	semver	—
`[0,2.6.26)`	unaffected	semver	—
`[5.10.269,5.11.0)`	unaffected	semver	—
`[5.15.220,5.16.0)`	unaffected	semver	—
`[6.1.187,6.2.0)`	unaffected	semver	—
`[6.6.156,6.7.0)`	unaffected	semver	—
`[6.12.108,6.13.0)`	unaffected	semver	—
`[6.18.49,6.19.0)`	unaffected	semver	—
`[7.1.13,7.2.0)`	unaffected	semver	—
`[7.2.3,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4777-1	linux security update
Debian DLA	DLA-4817-1	linux-6.12 security update
Debian DSA	DSA-6528-1	linux security update
Ubuntu USN	USN-8961-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9019-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9020-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9022-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9023-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9024-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9025-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9026-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9029-1	Linux kernel (Raspberry Pi) vulnerabilities
Ubuntu USN	USN-9039-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-9040-1	Linux kernel (Low Latency NVIDIA) vulnerabilities
Ubuntu USN	USN-9066-1	Linux kernel (HWE) vulnerabilities
Ubuntu USN	USN-9091-1	Linux kernel (NVIDIA Tegra) vulnerabilities

Metrics

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.195% probability within 30 days)

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/62cd519ab74cac499036cd88c11692f8f0d53e14
https://git.kernel.org/stable/c/7983daa159981fac125db2457437723f38ea1472
https://git.kernel.org/stable/c/ade18b4ce78a16558f4f435aece80082f6f7b64c
https://git.kernel.org/stable/c/b1e24de475bf2d66fffc9103f3444b783527d55a
https://git.kernel.org/stable/c/b4cb8081cf80f82e48fbe9c021a8f6d0fa2ed421
https://git.kernel.org/stable/c/bb572801290e25ec1c4753d14af35777303f5d6b
https://git.kernel.org/stable/c/e4039e9bebb528dd9cd7ac72aeaec529c26c355a
https://git.kernel.org/stable/c/f24dcc61bd0ecf7639fac5bf700450b398d793a7
https://git.kernel.org/stable/c/ff172092cba7ec990ecc7b610ce703e19570b8f0

History

Sep 4, 2026 7:15 PM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-416

Sep 4, 2026 4:00 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: USB: c67x00: fix use-after-free in c67x00_add_iso_urb() When TD creation fails for the last packet of an isochronous URB, c67x00_add_iso_urb() gives the URB back before updating the endpoint scheduling state. c67x00_giveback_urb() frees the URB private data, and the completion callback may release the final URB reference. The following accesses to urbp->ep_data, urb->interval, and urbp->cnt can therefore use freed memory. Update next_frame and cnt before giving back the failed final packet, making the giveback the last operation that uses the URB and its private data.
Title		USB: c67x00: fix use-after-free in c67x00_add_iso_urb()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/62cd519ab74cac499036cd88c11692f8f0d53e14 https://git.kernel.org/stable/c/7983daa159981fac125db2457437723f38ea1472 https://git.kernel.org/stable/c/ade18b4ce78a16558f4f435aece80082f6f7b64c https://git.kernel.org/stable/c/b1e24de475bf2d66fffc9103f3444b783527d55a https://git.kernel.org/stable/c/b4cb8081cf80f82e48fbe9c021a8f6d0fa2ed421 https://git.kernel.org/stable/c/bb572801290e25ec1c4753d14af35777303f5d6b https://git.kernel.org/stable/c/e4039e9bebb528dd9cd7ac72aeaec529c26c355a https://git.kernel.org/stable/c/f24dcc61bd0ecf7639fac5bf700450b398d793a7 https://git.kernel.org/stable/c/ff172092cba7ec990ecc7b610ce703e19570b8f0