GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-64583 (GCVE-0-2026-64583)

Vulnerability from cvelistv5 – Published: 2026-08-06 07:06 – Updated: 2026-08-23 12:45
VLAI
Title
usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown
Summary
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown The Broadcom BDC UDC driver registers its IRQ handler with devm_request_irq() in bdc_udc_init(), so the IRQ is released by devm only after bdc_remove() returns. devm releases resources in reverse LIFO order, but bdc_remove() runs bdc_udc_exit() and bdc_hw_exit() -> bdc_mem_free() manually before returning: bdc_udc_exit() tears down individual endpoint objects via bdc_free_ep(), while bdc_hw_exit() -> bdc_mem_free() frees and NULLs the DMA-coherent status-report ring (bdc->srr.sr_bds) and kfree()s bdc->bdc_ep_array. Both happen while the IRQ handler (bdc_udc_interrupt, requested with IRQF_SHARED) remains deliverable in the window up to the post-remove devm free_irq(). On receipt of a shared interrupt in that window, bdc_udc_interrupt() dereferences bdc->srr.sr_bds[bdc->srr.dqp_index] (NULL or freed DMA) and dispatches sr_handler callbacks that index into bdc_ep_array, causing a NULL-deref or use-after-free. The same window affects the delayed_work bdc->func_wake_notify, which is armed from the IRQ handler via bdc_sr_uspc() -> handle_link_state_change() -> schedule_delayed_work() and may self-rearm from its own callback bdc_func_wake_timer(). No cancel exists anywhere in the driver, so a queued work item that fires after bdc_remove() returns and the bdc structure is devm-freed dereferences freed memory. Replace devm_request_irq() with request_irq() and add an explicit free_irq(bdc->irq, bdc) in bdc_remove(). Clear BDC_GIE before free_irq() to stop the device from asserting interrupts, then free_irq() drains any in-flight handler, then cancel_delayed_work_sync() drains the func_wake_notify delayed work. This ordering ensures the IRQ handler and delayed work cannot interfere with the subsequent endpoint and DMA teardown in bdc_udc_exit() and bdc_hw_exit(). Wire the matching free_irq() into the bdc_udc_init() error path so the IRQ is released on probe failure, and route the bdc_init_ep() failure through err0 instead of returning directly. This issue was found by an in-house static analysis tool.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: efed421a94e62a7ddbc76acba4312b70e4be958f , < eac1107e54679db2df2c36d8bba3b66d3ab6cbcd (git)
Affected: efed421a94e62a7ddbc76acba4312b70e4be958f , < 0b0b76e31b3991a899ae724eb97d359de0c0f1b1 (git)
Affected: efed421a94e62a7ddbc76acba4312b70e4be958f , < 3fe181952b8a1aeb167d4503c794c0f5050f08ed (git)
Affected: efed421a94e62a7ddbc76acba4312b70e4be958f , < 1a1d7158420df6b8fa1efc0cdd6ab704801a4fc8 (git)
Affected: efed421a94e62a7ddbc76acba4312b70e4be958f , < f6fc21ec7ccd83726ba766d73d0b8cc03e726475 (git)
Affected: efed421a94e62a7ddbc76acba4312b70e4be958f , < dcf3e2f164435b5844706cb8eefef29ebee0eedb (git)
Affected: efed421a94e62a7ddbc76acba4312b70e4be958f , < d4964a74717107697999f48bcb4e80a9c0679a27 (git)
Affected: efed421a94e62a7ddbc76acba4312b70e4be958f , < 0583f2fbf8f86ae3a0ce054f96783dd83e65d9bb (git)
guessed Create a notification for this product.
Linux Linux Affected: 3.19
Unaffected: 0 , < 3.19 (semver)
Unaffected: 5.10.266 , ≤ 5.10.* (semver)
Unaffected: 5.15.216 , ≤ 5.15.* (semver)
Unaffected: 6.1.183 , ≤ 6.1.* (semver)
Unaffected: 6.6.148 , ≤ 6.6.* (semver)
Unaffected: 6.12.101 , ≤ 6.12.* (semver)
Unaffected: 6.18.42 , ≤ 6.18.* (semver)
Unaffected: 7.1.6 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/gadget/udc/bdc/bdc_core.c",
            "drivers/usb/gadget/udc/bdc/bdc_udc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "eac1107e54679db2df2c36d8bba3b66d3ab6cbcd",
              "status": "affected",
              "version": "efed421a94e62a7ddbc76acba4312b70e4be958f",
              "versionType": "git"
            },
            {
              "lessThan": "0b0b76e31b3991a899ae724eb97d359de0c0f1b1",
              "status": "affected",
              "version": "efed421a94e62a7ddbc76acba4312b70e4be958f",
              "versionType": "git"
            },
            {
              "lessThan": "3fe181952b8a1aeb167d4503c794c0f5050f08ed",
              "status": "affected",
              "version": "efed421a94e62a7ddbc76acba4312b70e4be958f",
              "versionType": "git"
            },
            {
              "lessThan": "1a1d7158420df6b8fa1efc0cdd6ab704801a4fc8",
              "status": "affected",
              "version": "efed421a94e62a7ddbc76acba4312b70e4be958f",
              "versionType": "git"
            },
            {
              "lessThan": "f6fc21ec7ccd83726ba766d73d0b8cc03e726475",
              "status": "affected",
              "version": "efed421a94e62a7ddbc76acba4312b70e4be958f",
              "versionType": "git"
            },
            {
              "lessThan": "dcf3e2f164435b5844706cb8eefef29ebee0eedb",
              "status": "affected",
              "version": "efed421a94e62a7ddbc76acba4312b70e4be958f",
              "versionType": "git"
            },
            {
              "lessThan": "d4964a74717107697999f48bcb4e80a9c0679a27",
              "status": "affected",
              "version": "efed421a94e62a7ddbc76acba4312b70e4be958f",
              "versionType": "git"
            },
            {
              "lessThan": "0583f2fbf8f86ae3a0ce054f96783dd83e65d9bb",
              "status": "affected",
              "version": "efed421a94e62a7ddbc76acba4312b70e4be958f",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/gadget/udc/bdc/bdc_core.c",
            "drivers/usb/gadget/udc/bdc/bdc_udc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.19"
            },
            {
              "lessThan": "3.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.266",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.148",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.101",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.266",
                  "versionStartIncluding": "3.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.216",
                  "versionStartIncluding": "3.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "3.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.148",
                  "versionStartIncluding": "3.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.101",
                  "versionStartIncluding": "3.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.42",
                  "versionStartIncluding": "3.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.6",
                  "versionStartIncluding": "3.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "3.19",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown\n\nThe Broadcom BDC UDC driver registers its IRQ handler with\ndevm_request_irq() in bdc_udc_init(), so the IRQ is released by devm\nonly after bdc_remove() returns.  devm releases resources in reverse\nLIFO order, but bdc_remove() runs bdc_udc_exit() and bdc_hw_exit() -\u003e\nbdc_mem_free() manually before returning: bdc_udc_exit() tears down\nindividual endpoint objects via bdc_free_ep(), while bdc_hw_exit() -\u003e\nbdc_mem_free() frees and NULLs the DMA-coherent status-report ring\n(bdc-\u003esrr.sr_bds) and kfree()s bdc-\u003ebdc_ep_array.  Both happen while\nthe IRQ handler (bdc_udc_interrupt, requested with IRQF_SHARED)\nremains deliverable in the window up to the post-remove devm\nfree_irq().\n\nOn receipt of a shared interrupt in that window, bdc_udc_interrupt()\ndereferences bdc-\u003esrr.sr_bds[bdc-\u003esrr.dqp_index] (NULL or freed DMA)\nand dispatches sr_handler callbacks that index into bdc_ep_array,\ncausing a NULL-deref or use-after-free.\n\nThe same window affects the delayed_work bdc-\u003efunc_wake_notify, which is\narmed from the IRQ handler via bdc_sr_uspc() -\u003e handle_link_state_change()\n-\u003e schedule_delayed_work() and may self-rearm from its own callback\nbdc_func_wake_timer().  No cancel exists anywhere in the driver, so a\nqueued work item that fires after bdc_remove() returns and the bdc\nstructure is devm-freed dereferences freed memory.\n\nReplace devm_request_irq() with request_irq() and add an explicit\nfree_irq(bdc-\u003eirq, bdc) in bdc_remove().  Clear BDC_GIE before\nfree_irq() to stop the device from asserting interrupts, then\nfree_irq() drains any in-flight handler, then cancel_delayed_work_sync()\ndrains the func_wake_notify delayed work.  This ordering ensures the\nIRQ handler and delayed work cannot interfere with the subsequent\nendpoint and DMA teardown in bdc_udc_exit() and bdc_hw_exit().  Wire the\nmatching free_irq() into the bdc_udc_init() error path so the IRQ is\nreleased on probe failure, and route the bdc_init_ep() failure through\nerr0 instead of returning directly.\n\nThis issue was found by an in-house static analysis tool."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable window opens on local BDC platform-driver teardown (sysfs unbind/rmmod \u2192 bdc_remove), not on parsing USB host packets; that matches other USB gadget/UDC teardown UAFs scored AV:L and is higher severity than Physical.\nAC:L - The attacker controls remove/bind retries; a pending func_wake_notify (never cancelled before the fix) runs deterministically on the post-remove freed bdc, and IRQF_SHARED plus USB activity can also hit the IRQ window during teardown.\nPR:L - Highest reasonable exposure is a local account managing the gadget/UDC on Android or Broadcom STB systems where platform unbind is delegated beyond init-namespace root; uncertain Low vs High, so Low per the overestimate rule.\nUI:N - The attacker performs driver remove and any prior link-state activity that arms func_wake_notify themselves; no separate victim mount, open, or other interaction is required.\nS:U - NULL-deref/use-after-free of sr_bds, bdc_ep_array, and the delayed-work bdc object stays inside the host kernel authority and does not cross a VM, IOMMU, or sandbox boundary.\nC:H - Use-after-free of the DMA status-report ring, endpoint array, and the bdc object via IRQ/work handlers allows reclaim/spray and disclosure of kernel memory, which per UAF guidance is High.\nI:H - The same UAF paths write through freed endpoint/status structures and run delayed work on a freed bdc, enabling heap corruption and control-flow hijack suitable for privilege escalation.\nA:H - Dereferencing NULL/freed sr_bds in hard-IRQ context or executing bdc_func_wake_timer on a post-remove freed bdc causes kernel oops/panic, so availability impact is High."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-23T12:45:42.500Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/eac1107e54679db2df2c36d8bba3b66d3ab6cbcd"
        },
        {
          "url": "https://git.kernel.org/stable/c/0b0b76e31b3991a899ae724eb97d359de0c0f1b1"
        },
        {
          "url": "https://git.kernel.org/stable/c/3fe181952b8a1aeb167d4503c794c0f5050f08ed"
        },
        {
          "url": "https://git.kernel.org/stable/c/1a1d7158420df6b8fa1efc0cdd6ab704801a4fc8"
        },
        {
          "url": "https://git.kernel.org/stable/c/f6fc21ec7ccd83726ba766d73d0b8cc03e726475"
        },
        {
          "url": "https://git.kernel.org/stable/c/dcf3e2f164435b5844706cb8eefef29ebee0eedb"
        },
        {
          "url": "https://git.kernel.org/stable/c/d4964a74717107697999f48bcb4e80a9c0679a27"
        },
        {
          "url": "https://git.kernel.org/stable/c/0583f2fbf8f86ae3a0ce054f96783dd83e65d9bb"
        }
      ],
      "title": "usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64583",
    "datePublished": "2026-08-06T07:06:25.335Z",
    "dateReserved": "2026-07-19T15:36:31.798Z",
    "dateUpdated": "2026-08-23T12:45:42.500Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-64583",
      "date": "2026-09-18",
      "epss": "0.00117",
      "percentile": "0.01889"
    },
    "microsoft_vex": {
      "current_release_date": "2026-08-09T01:43:38.000Z",
      "cve": "CVE-2026-64583",
      "id": "msrc_CVE-2026-64583",
      "initial_release_date": "2026-08-07T01:14:29.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-64583.json",
      "version": "2"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/usb/gadget/udc/bdc/bdc_core.c",
                  "drivers/usb/gadget/udc/bdc/bdc_udc.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "eac1107e54679db2df2c36d8bba3b66d3ab6cbcd",
                    "status": "affected",
                    "version": "efed421a94e62a7ddbc76acba4312b70e4be958f",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "0b0b76e31b3991a899ae724eb97d359de0c0f1b1",
                    "status": "affected",
                    "version": "efed421a94e62a7ddbc76acba4312b70e4be958f",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "3fe181952b8a1aeb167d4503c794c0f5050f08ed",
                    "status": "affected",
                    "version": "efed421a94e62a7ddbc76acba4312b70e4be958f",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "1a1d7158420df6b8fa1efc0cdd6ab704801a4fc8",
                    "status": "affected",
                    "version": "efed421a94e62a7ddbc76acba4312b70e4be958f",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "f6fc21ec7ccd83726ba766d73d0b8cc03e726475",
                    "status": "affected",
                    "version": "efed421a94e62a7ddbc76acba4312b70e4be958f",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "dcf3e2f164435b5844706cb8eefef29ebee0eedb",
                    "status": "affected",
                    "version": "efed421a94e62a7ddbc76acba4312b70e4be958f",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "d4964a74717107697999f48bcb4e80a9c0679a27",
                    "status": "affected",
                    "version": "efed421a94e62a7ddbc76acba4312b70e4be958f",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "0583f2fbf8f86ae3a0ce054f96783dd83e65d9bb",
                    "status": "affected",
                    "version": "efed421a94e62a7ddbc76acba4312b70e4be958f",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/usb/gadget/udc/bdc/bdc_core.c",
                  "drivers/usb/gadget/udc/bdc/bdc_udc.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "3.19"
                  },
                  {
                    "lessThan": "3.19",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.266",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.216",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.183",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.148",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.101",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.42",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.6",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown\n\nThe Broadcom BDC UDC driver registers its IRQ handler with\ndevm_request_irq() in bdc_udc_init(), so the IRQ is released by devm\nonly after bdc_remove() returns.  devm releases resources in reverse\nLIFO order, but bdc_remove() runs bdc_udc_exit() and bdc_hw_exit() -\u003e\nbdc_mem_free() manually before returning: bdc_udc_exit() tears down\nindividual endpoint objects via bdc_free_ep(), while bdc_hw_exit() -\u003e\nbdc_mem_free() frees and NULLs the DMA-coherent status-report ring\n(bdc-\u003esrr.sr_bds) and kfree()s bdc-\u003ebdc_ep_array.  Both happen while\nthe IRQ handler (bdc_udc_interrupt, requested with IRQF_SHARED)\nremains deliverable in the window up to the post-remove devm\nfree_irq().\n\nOn receipt of a shared interrupt in that window, bdc_udc_interrupt()\ndereferences bdc-\u003esrr.sr_bds[bdc-\u003esrr.dqp_index] (NULL or freed DMA)\nand dispatches sr_handler callbacks that index into bdc_ep_array,\ncausing a NULL-deref or use-after-free.\n\nThe same window affects the delayed_work bdc-\u003efunc_wake_notify, which is\narmed from the IRQ handler via bdc_sr_uspc() -\u003e handle_link_state_change()\n-\u003e schedule_delayed_work() and may self-rearm from its own callback\nbdc_func_wake_timer().  No cancel exists anywhere in the driver, so a\nqueued work item that fires after bdc_remove() returns and the bdc\nstructure is devm-freed dereferences freed memory.\n\nReplace devm_request_irq() with request_irq() and add an explicit\nfree_irq(bdc-\u003eirq, bdc) in bdc_remove().  Clear BDC_GIE before\nfree_irq() to stop the device from asserting interrupts, then\nfree_irq() drains any in-flight handler, then cancel_delayed_work_sync()\ndrains the func_wake_notify delayed work.  This ordering ensures the\nIRQ handler and delayed work cannot interfere with the subsequent\nendpoint and DMA teardown in bdc_udc_exit() and bdc_hw_exit().  Wire the\nmatching free_irq() into the bdc_udc_init() error path so the IRQ is\nreleased on probe failure, and route the bdc_init_ep() failure through\nerr0 instead of returning directly.\n\nThis issue was found by an in-house static analysis tool."
          }
        ],
        "id": "CVE-2026-64583",
        "lastModified": "2026-08-23T13:16:31.950",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-08-06T08:16:33.390",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/0583f2fbf8f86ae3a0ce054f96783dd83e65d9bb"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/0b0b76e31b3991a899ae724eb97d359de0c0f1b1"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/1a1d7158420df6b8fa1efc0cdd6ab704801a4fc8"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/3fe181952b8a1aeb167d4503c794c0f5050f08ed"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/d4964a74717107697999f48bcb4e80a9c0679a27"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/dcf3e2f164435b5844706cb8eefef29ebee0eedb"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/eac1107e54679db2df2c36d8bba3b66d3ab6cbcd"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/f6fc21ec7ccd83726ba766d73d0b8cc03e726475"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-18T00:37:35Z",
      "cve": "CVE-2026-64583",
      "id": "CVE-2026-64583",
      "initial_release_date": "2026-08-06T23:56:02Z",
      "product_status:known_affected": "394",
      "product_status:known_not_affected": "337",
      "product_status:recommended": "111",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-64583",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-64583.json",
      "version": "8"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.