{"id":"CVE-2026-80826","revision":"1ee8ae08718146068b4518430a79540e","records":[{"revision":"1ee8ae08718146068b4518430a79540e","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-80826","aliases":[],"title":"USB: c67x00: fix use-after-free in c67x00_add_iso_urb()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: c67x00: fix use-after-free in c67x00_add_iso_urb()\n\nWhen TD creation fails for the last packet of an isochronous URB,\nc67x00_add_iso_urb() gives the URB back before updating the endpoint\nscheduling state.\n\nc67x00_giveback_urb() frees the URB private data, and the completion\ncallback may release the final URB reference. The following accesses to\nurbp->ep_data, urb->interval, and urbp->cnt can therefore use freed\nmemory.\n\nUpdate next_frame and cnt before giving back the failed final packet,\nmaking the giveback the last operation that uses the URB and its private\ndata.","state":0,"publishedAt":"2026-09-04T15:54:30.131+00:00","modifiedAt":"2026-10-19T08:44:18.781+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/usb/c67x00/c67x00-sched.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"e9b29ffc519b9e63d4e1c0b1278bb951bb418a9d\",\n                            \"lessThan\": \"e4039e9bebb528dd9cd7ac72aeaec529c26c355a\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"e9b29ffc519b9e63d4e1c0b1278bb951bb418a9d\",\n                            \"lessThan\": \"ade18b4ce78a16558f4f435aece80082f6f7b64c\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"e9b29ffc519b9e63d4e1c0b1278bb951bb418a9d\",\n                            \"lessThan\": \"bb572801290e25ec1c4753d14af35777303f5d6b\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"e9b29ffc519b9e63d4e1c0b1278bb951bb418a9d\",\n                            \"lessThan\": \"62cd519ab74cac499036cd88c11692f8f0d53e14\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"e9b29ffc519b9e63d4e1c0b1278bb951bb418a9d\",\n                            \"lessThan\": \"ff172092cba7ec990ecc7b610ce703e19570b8f0\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"e9b29ffc519b9e63d4e1c0b1278bb951bb418a9d\",\n                            \"lessThan\": \"b4cb8081cf80f82e48fbe9c021a8f6d0fa2ed421\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"e9b29ffc519b9e63d4e1c0b1278bb951bb418a9d\",\n                            \"lessThan\": \"7983daa159981fac125db2457437723f38ea1472\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"e9b29ffc519b9e63d4e1c0b1278bb951bb418a9d\",\n                            \"lessThan\": \"f24dcc61bd0ecf7639fac5bf700450b398d793a7\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"e9b29ffc519b9e63d4e1c0b1278bb951bb418a9d\",\n                            \"lessThan\": \"b1e24de475bf2d66fffc9103f3444b783527d55a\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/usb/c67x00/c67x00-sched.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"2.6.26\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"2.6.26\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.10.269\",\n                            \"lessThanOrEqual\": \"5.10.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.220\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.187\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.156\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.108\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.49\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.1.13\",\n                            \"lessThanOrEqual\": \"7.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.3\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/e4039e9bebb528dd9cd7ac72aeaec529c26c355a","https://git.kernel.org/stable/c/ade18b4ce78a16558f4f435aece80082f6f7b64c","https://git.kernel.org/stable/c/bb572801290e25ec1c4753d14af35777303f5d6b","https://git.kernel.org/stable/c/62cd519ab74cac499036cd88c11692f8f0d53e14","https://git.kernel.org/stable/c/ff172092cba7ec990ecc7b610ce703e19570b8f0","https://git.kernel.org/stable/c/b4cb8081cf80f82e48fbe9c021a8f6d0fa2ed421","https://git.kernel.org/stable/c/7983daa159981fac125db2457437723f38ea1472","https://git.kernel.org/stable/c/f24dcc61bd0ecf7639fac5bf700450b398d793a7","https://git.kernel.org/stable/c/b1e24de475bf2d66fffc9103f3444b783527d55a"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-80826","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-80826","identifiers":["CVE-2026-80826"]},"retained":false,"historicalAffected":[]}],"coverage":[]}