CVE-2026-64583 - Vulnerability Details

Description

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown

The Broadcom BDC UDC driver registers its IRQ handler with
devm_request_irq() in bdc_udc_init(), so the IRQ is released by devm
only after bdc_remove() returns. devm releases resources in reverse
LIFO order, but bdc_remove() runs bdc_udc_exit() and bdc_hw_exit() ->
bdc_mem_free() manually before returning: bdc_udc_exit() tears down
individual endpoint objects via bdc_free_ep(), while bdc_hw_exit() ->
bdc_mem_free() frees and NULLs the DMA-coherent status-report ring
(bdc->srr.sr_bds) and kfree()s bdc->bdc_ep_array. Both happen while
the IRQ handler (bdc_udc_interrupt, requested with IRQF_SHARED)
remains deliverable in the window up to the post-remove devm
free_irq().

On receipt of a shared interrupt in that window, bdc_udc_interrupt()
dereferences bdc->srr.sr_bds[bdc->srr.dqp_index] (NULL or freed DMA)
and dispatches sr_handler callbacks that index into bdc_ep_array,
causing a NULL-deref or use-after-free.

The same window affects the delayed_work bdc->func_wake_notify, which is
armed from the IRQ handler via bdc_sr_uspc() -> handle_link_state_change()
-> schedule_delayed_work() and may self-rearm from its own callback
bdc_func_wake_timer(). No cancel exists anywhere in the driver, so a
queued work item that fires after bdc_remove() returns and the bdc
structure is devm-freed dereferences freed memory.

Replace devm_request_irq() with request_irq() and add an explicit
free_irq(bdc->irq, bdc) in bdc_remove(). Clear BDC_GIE before
free_irq() to stop the device from asserting interrupts, then
free_irq() drains any in-flight handler, then cancel_delayed_work_sync()
drains the func_wake_notify delayed work. This ordering ensures the
IRQ handler and delayed work cannot interfere with the subsequent
endpoint and DMA teardown in bdc_udc_exit() and bdc_hw_exit(). Wire the
matching free_irq() into the bdc_udc_init() error path so the IRQ is
released on probe failure, and route the bdc_init_ep() failure through
err0 instead of returning directly.

This issue was found by an in-house static analysis tool.

Published: 2026-08-06

Score: n/a

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The Broadcom BDC USB Gadget driver contains a use‑after‑free flaw that occurs when the device is removed. During teardown, the interrupt handler and a delayed work item continue to reference memory that has already been freed, leading to null dereference or other memory corruption. This can cause the kernel to panic, resulting in a denial‑of‑service. The vulnerability is limited to the Broadcom BDC UDC driver within the Linux kernel. Any system that includes this driver before the applied patch is susceptible. No CVSS or EPSS scores are available, and the flaw is not currently listed in the CISA KEV catalog. Exploitation requires local or privileged access to trigger the device removal while interrupts or delayed work are still pending. The risk is moderate to high for affected installations, but only with an outdated kernel that contains the vulnerable code path.

Affected Systems

All Linux systems that load the Broadcom BDC UDC driver included in kernel builds prior to the patch. The specific kernel versions are not enumerated, so any kernel release before the commit fixing this issue remains at risk.

Risk and Exploitability

The flaw is a classic use‑after‑free (CWE‑416) that can be leveraged to crash the kernel. Because the vulnerability is only triggered during device removal, it is best described as a local or privileged attack vector. While no publicly available exploit exists and EPSS is not available, the potential impact of a privilege escalation or denial‑of‑service makes it a priority to remediate. Updating to a kernel containing the fix eliminates the risk.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`efed421a94e62a7ddbc76acba4312b70e4be958f`	affected	< 1a1d7158420df6b8fa1efc0cdd6ab704801a4fc8
`efed421a94e62a7ddbc76acba4312b70e4be958f`	affected	< f6fc21ec7ccd83726ba766d73d0b8cc03e726475
`efed421a94e62a7ddbc76acba4312b70e4be958f`	affected	< dcf3e2f164435b5844706cb8eefef29ebee0eedb
`efed421a94e62a7ddbc76acba4312b70e4be958f`	affected	< d4964a74717107697999f48bcb4e80a9c0679a27
`efed421a94e62a7ddbc76acba4312b70e4be958f`	affected	< 0583f2fbf8f86ae3a0ce054f96783dd83e65d9bb

Linux

affected

Version	Status	Constraints
`3.19`	affected	—
`0`	unaffected	< 3.19
`6.6.148`	unaffected	≤ 6.6.*
`6.12.101`	unaffected	≤ 6.12.*
`6.18.42`	unaffected	≤ 6.18.*
`7.1.6`	unaffected	≤ 7.1.*
`7.2-rc5`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[efed421a94e62a7ddbc76acba4312b70e4be958f,1a1d7158420df6b8fa1efc0cdd6ab704801a4fc8)`	affected	code_commit	—
`[efed421a94e62a7ddbc76acba4312b70e4be958f,f6fc21ec7ccd83726ba766d73d0b8cc03e726475)`	affected	code_commit	—
`[efed421a94e62a7ddbc76acba4312b70e4be958f,dcf3e2f164435b5844706cb8eefef29ebee0eedb)`	affected	code_commit	—
`[efed421a94e62a7ddbc76acba4312b70e4be958f,d4964a74717107697999f48bcb4e80a9c0679a27)`	affected	code_commit	—
`[efed421a94e62a7ddbc76acba4312b70e4be958f,0583f2fbf8f86ae3a0ce054f96783dd83e65d9bb)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`3.19`	affected	semver	—
`[0,3.19)`	unaffected	semver	—
`[6.6.148,6.7.0)`	unaffected	semver	—
`[6.12.101,6.13.0)`	unaffected	semver	—
`[6.18.42,6.19.0)`	unaffected	semver	—
`[7.1.6,7.2.0)`	unaffected	semver	—
`[7.2-rc5,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply a kernel update that contains the Broadcom BDC UDC fix, which replaces devm_request_irq() with request_irq() and adds explicit free_irq() and cancel_delayed_work_sync() calls.
If a kernel upgrade cannot be performed immediately, unload the bdc_udc module before attempting to remove or power‑cycle the device to prevent the freed resources from being accessed.
If device removal is unavoidable, manually stop the module, verify that no pending interrupts or delayed work are scheduled, then re‑load the module or apply a temporary patch that performs the same cleanup steps as the official fix.

Generated by OpenCVE AI on August 6, 2026 at 08:54 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DSA	DSA-6415-1	linux security update

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00156.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/0583f2fbf8f86ae3a0ce054f96783dd83e65d9bb
https://git.kernel.org/stable/c/1a1d7158420df6b8fa1efc0cdd6ab704801a4fc8
https://git.kernel.org/stable/c/d4964a74717107697999f48bcb4e80a9c0679a27
https://git.kernel.org/stable/c/dcf3e2f164435b5844706cb8eefef29ebee0eedb
https://git.kernel.org/stable/c/f6fc21ec7ccd83726ba766d73d0b8cc03e726475

History

Thu, 06 Aug 2026 07:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown The Broadcom BDC UDC driver registers its IRQ handler with devm_request_irq() in bdc_udc_init(), so the IRQ is released by devm only after bdc_remove() returns. devm releases resources in reverse LIFO order, but bdc_remove() runs bdc_udc_exit() and bdc_hw_exit() -> bdc_mem_free() manually before returning: bdc_udc_exit() tears down individual endpoint objects via bdc_free_ep(), while bdc_hw_exit() -> bdc_mem_free() frees and NULLs the DMA-coherent status-report ring (bdc->srr.sr_bds) and kfree()s bdc->bdc_ep_array. Both happen while the IRQ handler (bdc_udc_interrupt, requested with IRQF_SHARED) remains deliverable in the window up to the post-remove devm free_irq(). On receipt of a shared interrupt in that window, bdc_udc_interrupt() dereferences bdc->srr.sr_bds[bdc->srr.dqp_index] (NULL or freed DMA) and dispatches sr_handler callbacks that index into bdc_ep_array, causing a NULL-deref or use-after-free. The same window affects the delayed_work bdc->func_wake_notify, which is armed from the IRQ handler via bdc_sr_uspc() -> handle_link_state_change() -> schedule_delayed_work() and may self-rearm from its own callback bdc_func_wake_timer(). No cancel exists anywhere in the driver, so a queued work item that fires after bdc_remove() returns and the bdc structure is devm-freed dereferences freed memory. Replace devm_request_irq() with request_irq() and add an explicit free_irq(bdc->irq, bdc) in bdc_remove(). Clear BDC_GIE before free_irq() to stop the device from asserting interrupts, then free_irq() drains any in-flight handler, then cancel_delayed_work_sync() drains the func_wake_notify delayed work. This ordering ensures the IRQ handler and delayed work cannot interfere with the subsequent endpoint and DMA teardown in bdc_udc_exit() and bdc_hw_exit(). Wire the matching free_irq() into the bdc_udc_init() error path so the IRQ is released on probe failure, and route the bdc_init_ep() failure through err0 instead of returning directly. This issue was found by an in-house static analysis tool.
Title		usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/0583f2fbf8f86ae3a0ce054f96783dd83e65d9bb https://git.kernel.org/stable/c/1a1d7158420df6b8fa1efc0cdd6ab704801a4fc8 https://git.kernel.org/stable/c/d4964a74717107697999f48bcb4e80a9c0679a27 https://git.kernel.org/stable/c/dcf3e2f164435b5844706cb8eefef29ebee0eedb https://git.kernel.org/stable/c/f6fc21ec7ccd83726ba766d73d0b8cc03e726475

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-06T07:06:25.335Z

Updated: 2026-08-06T07:06:25.335Z

Reserved: 2026-07-19T15:36:31.798Z

Link: CVE-2026-64583

Vulnrichment

No data.

NVD

No data.

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-08-06T09:00:11Z

Weaknesses

No weakness.

Impact

Affected Systems

Risk and Exploitability

Tracking

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object