Skip to content
Heist/ feed
UnratedFix available

usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown

Type: advisorySource: OSV1 source record

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown The Broadcom BDC UDC driver registers its IRQ handler with devm_request_irq() in bdc_udc_init(), so the IRQ is released by devm only after bdc_remove() returns. devm releases resources in reverse LIFO order, but bdc_remove() runs bdc_udc_exit() and bdc_hw_exit() -> bdc_mem_free() manually before returning: bdc_udc_exit() tears down individual endpoint objects via bdc_free_ep(), while bdc_hw_exit() -> bdc_mem_free() frees and NULLs the DMA-coherent status-report ring (bdc->srr.sr_bds) and kfree()s bdc->bdc_ep_array. Both happen while the IRQ handler (bdc_udc_interrupt, requested with IRQF_SHARED) remains deliverable in the window up to the post-remove devm free_irq(). On receipt of a shared interrupt in that window, bdc_udc_interrupt() dereferences bdc->srr.sr_bds[bdc->srr.dqp_index] (NULL or freed DMA) and dispatches sr_handler callbacks that index into bdc_ep_array, causing a NULL-deref or use-after-free. The same window affects the delayed_work bdc->func_wake_notify, which is armed from the IRQ handler via bdc_sr_uspc() -> handle_link_state_change() -> schedule_delayed_work() and may self-rearm from its own callback bdc_func_wake_timer(). No cancel exists anywhere in the driver, so a queued work item that fires after bdc_remove() returns and the bdc structure is devm-freed dereferences freed memory. Replace devm_request_irq() with re

Announced Source revision 1
Original source ↗

CVE-2026-64583

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:CVE-2026-64583

Kernel

Source reference: /affected/1/package/name

Affected versions
Not stated in this record
Fixed versions
5.10.266

Source reference: /affected/1/ranges

5.15.216

Source reference: /affected/1/ranges

6.1.183

Source reference: /affected/1/ranges

6.6.148

Source reference: /affected/1/ranges

6.12.101

Source reference: /affected/1/ranges

6.18.42

Source reference: /affected/1/ranges

7.1.6

Source reference: /affected/1/ranges

Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
        "type": "GIT",
        "events": [
          {
            "introduced": "efed421a94e62a7ddbc76acba4312b70e4be958f"
          },
          {
            "fixed": "eac1107e54679db2df2c36d8bba3b66d3ab6cbcd"
          },
          {
            "fixed": "0b0b76e31b3991a899ae724eb97d359de0c0f1b1"
          },
          {
            "fixed": "3fe181952b8a1aeb167d4503c794c0f5050f08ed"
          },
          {
            "fixed": "1a1d7158420df6b8fa1efc0cdd6ab704801a4fc8"
          },
          {
            "fixed": "f6fc21ec7ccd83726ba766d73d0b8cc03e726475"
          },
          {
            "fixed": "dcf3e2f164435b5844706cb8eefef29ebee0eedb"
          },
          {
            "fixed": "d4964a74717107697999f48bcb4e80a9c0679a27"
          },
          {
            "fixed": "0583f2fbf8f86ae3a0ce054f96783dd83e65d9bb"
          }
        ]
      }
    ],
    "database_specific": {
      "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-64583.json"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "3.19.0"
          },
          {
            "fixed": "5.10.266"
          }
        ]
      },
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "5.11.0"
          },
          {
            "fixed": "5.15.216"
          }
        ]
      },
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "5.16.0"
          },
          {
            "fixed": "6.1.183"
          }
        ]
      },
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "6.2.0"
          },
          {
            "fixed": "6.6.148"
          }
        ]
      },
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "6.7.0"
          },
          {
            "fixed": "6.12.101"
          }
        ]
      },
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "6.13.0"
          },
          {
            "fixed": "6.18.42"
          }
        ]
      },
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "6.19.0"
          },
          {
            "fixed": "7.1.6"
          }
        ]
      }
    ],
    "package": {
      "name": "Kernel",
      "ecosystem": "Linux"
    },
    "database_specific": {
      "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-64583.json"
    }
  }
]
Related CVEs
CVE-2026-64583

Source reference: /id

Publisher severity

No explicit severity was provided.

Event
#50694 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement