CVE-2026-64583— Linux kernel 安全漏洞
一分钟漏洞结论
影响对象
Linux Linux
利用判断
尚无明确在野利用证据，仍需结合暴露面评估
建议动作
优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。
Linux kernel是美国Linux基金会开源的一款操作系统内核。 Linux kernel 3.19版本存在安全漏洞，该漏洞源于Broadcom BDC UDC驱动在拆卸前未释放IRQ并排空func_wake_notify，可能导致空指针取消引用或释放后重用。
影响版本矩阵 18
| 厂商 | 产品 | 版本范围 | 状态 |
|---|---|---|---|
| Linux | Linux | efed421a94e62a7ddbc76acba4312b70e4be958f< eac1107e54679db2df2c36d8bba3b66d3ab6cbcd |
affected |
efed421a94e62a7ddbc76acba4312b70e4be958f< 0b0b76e31b3991a899ae724eb97d359de0c0f1b1 |
affected | ||
efed421a94e62a7ddbc76acba4312b70e4be958f< 3fe181952b8a1aeb167d4503c794c0f5050f08ed |
affected | ||
efed421a94e62a7ddbc76acba4312b70e4be958f< 1a1d7158420df6b8fa1efc0cdd6ab704801a4fc8 |
affected | ||
efed421a94e62a7ddbc76acba4312b70e4be958f< f6fc21ec7ccd83726ba766d73d0b8cc03e726475 |
affected | ||
efed421a94e62a7ddbc76acba4312b70e4be958f< dcf3e2f164435b5844706cb8eefef29ebee0eedb |
affected | ||
efed421a94e62a7ddbc76acba4312b70e4be958f< d4964a74717107697999f48bcb4e80a9c0679a27 |
affected | ||
efed421a94e62a7ddbc76acba4312b70e4be958f< 0583f2fbf8f86ae3a0ce054f96783dd83e65d9bb |
affected | ||
| … +10 条更多 | |||
获取后续新漏洞提醒
登录后订阅
一、 漏洞 CVE-2026-64583 基础信息
漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown
来源: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown
The Broadcom BDC UDC driver registers its IRQ handler with
devm_request_irq() in bdc_udc_init(), so the IRQ is released by devm
only after bdc_remove() returns. devm releases resources in reverse
LIFO order, but bdc_remove() runs bdc_udc_exit() and bdc_hw_exit() ->
bdc_mem_free() manually before returning: bdc_udc_exit() tears down
individual endpoint objects via bdc_free_ep(), while bdc_hw_exit() ->
bdc_mem_free() frees and NULLs the DMA-coherent status-report ring
(bdc->srr.sr_bds) and kfree()s bdc->bdc_ep_array. Both happen while
the IRQ handler (bdc_udc_interrupt, requested with IRQF_SHARED)
remains deliverable in the window up to the post-remove devm
free_irq().
On receipt of a shared interrupt in that window, bdc_udc_interrupt()
dereferences bdc->srr.sr_bds[bdc->srr.dqp_index] (NULL or freed DMA)
and dispatches sr_handler callbacks that index into bdc_ep_array,
causing a NULL-deref or use-after-free.
The same window affects the delayed_work bdc->func_wake_notify, which is
armed from the IRQ handler via bdc_sr_uspc() -> handle_link_state_change()
-> schedule_delayed_work() and may self-rearm from its own callback
bdc_func_wake_timer(). No cancel exists anywhere in the driver, so a
queued work item that fires after bdc_remove() returns and the bdc
structure is devm-freed dereferences freed memory.
Replace devm_request_irq() with request_irq() and add an explicit
free_irq(bdc->irq, bdc) in bdc_remove(). Clear BDC_GIE before
free_irq() to stop the device from asserting interrupts, then
free_irq() drains any in-flight handler, then cancel_delayed_work_sync()
drains the func_wake_notify delayed work. This ordering ensures the
IRQ handler and delayed work cannot interfere with the subsequent
endpoint and DMA teardown in bdc_udc_exit() and bdc_hw_exit(). Wire the
matching free_irq() into the bdc_udc_init() error path so the IRQ is
released on probe failure, and route the bdc_init_ep() failure through
err0 instead of returning directly.
This issue was found by an in-house static analysis tool.
来源: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
来源: CVE Program / CVE List V5
Vulnerability Type
N/A
来源: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
来源: 中国国家信息安全漏洞库 CNNVD
Vulnerability Description
Linux kernel是美国Linux基金会开源的一款操作系统内核。 Linux kernel 3.19版本存在安全漏洞，该漏洞源于Broadcom BDC UDC驱动在拆卸前未释放IRQ并排空func_wake_notify，可能导致空指针取消引用或释放后重用。
来源: 中国国家信息安全漏洞库 CNNVD
CVSS Information
N/A
来源: 中国国家信息安全漏洞库 CNNVD
Vulnerability Type
N/A
来源: 中国国家信息安全漏洞库 CNNVD
受影响产品
二、漏洞 CVE-2026-64583 的公开POC
| # | POC 描述 | 源链接 | 神龙链接 |
|---|
AI 生成 POC
高级
未找到公开 POC。
登录以生成 AI POC三、漏洞 CVE-2026-64583 的情报信息
请登录查看更多情报信息。
CVE-2026-64583 补丁与修复 (8)
同批安全公告 · Linux · 2026-08-06 · 共 22 条
| CVE-2026-64597 | 9.8 CRITICAL | Linux kernel 安全漏洞 |
| CVE-2026-64586 | 8.8 HIGH | Linux kernel 安全漏洞 |
| CVE-2026-64598 | 8.8 HIGH | Linux kernel 安全漏洞 |
| CVE-2026-64585 | 7.8 HIGH | Linux kernel 安全漏洞 |
| CVE-2026-64588 | 7.8 HIGH | Linux kernel 安全漏洞 |
| CVE-2026-64584 | 7.8 HIGH | Linux kernel 安全漏洞 |
| CVE-2026-64601 | 7.8 HIGH | Linux kernel 安全漏洞 |
| CVE-2026-64599 | 7.8 HIGH | Linux kernel 安全漏洞 |
| CVE-2026-64587 | 7.0 HIGH | Linux kernel 安全漏洞 |
| CVE-2026-68480 | Linux kernel 安全漏洞 | |
| CVE-2026-64604 | Linux kernel 安全漏洞 | |
| CVE-2026-64603 | Linux kernel 安全漏洞 | |
| CVE-2026-64602 | Linux kernel 安全漏洞 | |
| CVE-2026-64596 | Linux kernel 安全漏洞 | |
| CVE-2026-64595 | Linux kernel 安全漏洞 | |
| CVE-2026-64593 | Linux kernel 安全漏洞 | |
| CVE-2026-64594 | Linux kernel 安全漏洞 | |
| CVE-2026-64592 | Linux kernel 安全漏洞 | |
| CVE-2026-64591 | Linux kernel 安全漏洞 | |
| CVE-2026-64590 | Linux kernel 安全漏洞 |
显示前 20 条，共 22 条。 查看全部 → →
IV. Related Vulnerabilities
V. Comments for CVE-2026-64583
暂无评论