CVE-2026-80824

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

usb: usbfs: fix use-after-free of usb_device in usbdev_release()

usbdev_release() drops its reference to the struct usb_device before

draining the list of completed async URBs, but that drain path reads back

through the same object: free_async() calls dec_usb_memory_use_count()

for any URB whose buffer came from the usbfs mmap() region, and its first

statement is bus_to_hcd(ps->dev->bus).

After a disconnect the usbfs reference can be the last one, in which case

usb_put_dev() frees the device and the subsequent loop reads offset 80 of

freed memory and uses the result as a struct usb_hcd *, which

hcd_buffer_free_pages() then dereferences.

This is reachable by an unprivileged process that has read/write access to

a /dev/bus/usb node: mmap() the fd, submit one URB with a buffer inside the

mapping, wait for the device to be unplugged, then munmap() and close().

It reproduces on every attempt rather than being a race, be

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References