CVE-2026-64583

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown

The Broadcom BDC UDC driver registers its IRQ handler with

devm_request_irq() in bdc_udc_init(), so the IRQ is released by devm

only after bdc_remove() returns. devm releases resources in reverse

LIFO order, but bdc_remove() runs bdc_udc_exit() and bdc_hw_exit() ->

bdc_mem_free() manually before returning: bdc_udc_exit() tears down

individual endpoint objects via bdc_free_ep(), while bdc_hw_exit() ->

bdc_mem_free() frees and NULLs the DMA-coherent status-report ring

(bdc->srr.sr_bds) and kfree()s bdc->bdc_ep_array. Both happen while

the IRQ handler (bdc_udc_interrupt, requested with IRQF_SHARED)

remains deliverable in the window up to the post-remove devm

free_irq().

On receipt of a shared interrupt in that window, bdc_udc_interrupt()

dereferences bdc->srr.sr_bds[bdc->srr.dqp_index] (NULL or freed DMA)

and dispatches sr_handler callbacks th

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References