Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-64583— usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会开源的一款操作系统内核。 Linux kernel 3.19版本存在安全漏洞，该漏洞源于Broadcom BDC UDC驱动在拆卸前未释放IRQ并排空func_wake_notify，可能导致空指针取消引用或释放后重用。

CVSS 7.8 · High EPSS 0.12% · P2

Affected Version Matrix 18

VendorProduct Version RangeStatus
Linux Linux efed421a94e62a7ddbc76acba4312b70e4be958f< eac1107e54679db2df2c36d8bba3b66d3ab6cbcd affected
efed421a94e62a7ddbc76acba4312b70e4be958f< 0b0b76e31b3991a899ae724eb97d359de0c0f1b1 affected
efed421a94e62a7ddbc76acba4312b70e4be958f< 3fe181952b8a1aeb167d4503c794c0f5050f08ed affected
efed421a94e62a7ddbc76acba4312b70e4be958f< 1a1d7158420df6b8fa1efc0cdd6ab704801a4fc8 affected
efed421a94e62a7ddbc76acba4312b70e4be958f< f6fc21ec7ccd83726ba766d73d0b8cc03e726475 affected
efed421a94e62a7ddbc76acba4312b70e4be958f< dcf3e2f164435b5844706cb8eefef29ebee0eedb affected
efed421a94e62a7ddbc76acba4312b70e4be958f< d4964a74717107697999f48bcb4e80a9c0679a27 affected
efed421a94e62a7ddbc76acba4312b70e4be958f< 0583f2fbf8f86ae3a0ce054f96783dd83e65d9bb affected
… +10 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-64583

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown The Broadcom BDC UDC driver registers its IRQ handler with devm_request_irq() in bdc_udc_init(), so the IRQ is released by devm only after bdc_remove() returns. devm releases resources in reverse LIFO order, but bdc_remove() runs bdc_udc_exit() and bdc_hw_exit() -> bdc_mem_free() manually before returning: bdc_udc_exit() tears down individual endpoint objects via bdc_free_ep(), while bdc_hw_exit() -> bdc_mem_free() frees and NULLs the DMA-coherent status-report ring (bdc->srr.sr_bds) and kfree()s bdc->bdc_ep_array. Both happen while the IRQ handler (bdc_udc_interrupt, requested with IRQF_SHARED) remains deliverable in the window up to the post-remove devm free_irq(). On receipt of a shared interrupt in that window, bdc_udc_interrupt() dereferences bdc->srr.sr_bds[bdc->srr.dqp_index] (NULL or freed DMA) and dispatches sr_handler callbacks that index into bdc_ep_array, causing a NULL-deref or use-after-free. The same window affects the delayed_work bdc->func_wake_notify, which is armed from the IRQ handler via bdc_sr_uspc() -> handle_link_state_change() -> schedule_delayed_work() and may self-rearm from its own callback bdc_func_wake_timer(). No cancel exists anywhere in the driver, so a queued work item that fires after bdc_remove() returns and the bdc structure is devm-freed dereferences freed memory. Replace devm_request_irq() with request_irq() and add an explicit free_irq(bdc->irq, bdc) in bdc_remove(). Clear BDC_GIE before free_irq() to stop the device from asserting interrupts, then free_irq() drains any in-flight handler, then cancel_delayed_work_sync() drains the func_wake_notify delayed work. This ordering ensures the IRQ handler and delayed work cannot interfere with the subsequent endpoint and DMA teardown in bdc_udc_exit() and bdc_hw_exit(). Wire the matching free_irq() into the bdc_udc_init() error path so the IRQ is released on probe failure, and route the bdc_init_ep() failure through err0 instead of returning directly. This issue was found by an in-house static analysis tool.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会开源的一款操作系统内核。 Linux kernel 3.19版本存在安全漏洞，该漏洞源于Broadcom BDC UDC驱动在拆卸前未释放IRQ并排空func_wake_notify，可能导致空指针取消引用或释放后重用。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux efed421a94e62a7ddbc76acba4312b70e4be958f ~ eac1107e54679db2df2c36d8bba3b66d3ab6cbcd -
Linux Linux 3.19 -

II. Public POCs for CVE-2026-64583

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-64583

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-64583 (8)

Same Patch Batch · Linux · 2026-08-06 · 22 CVEs total

CVE-2026-64597 9.8 CRITICAL smb: client: fix double-free in SMB2_close() replay
CVE-2026-64586 8.8 HIGH wifi: brcmfmac: drain bus_reset work on device removal
CVE-2026-64598 8.8 HIGH smb/client: Fix error code in smb2_aead_req_alloc()
CVE-2026-64585 7.8 HIGH can: esd_usb: kill anchored URBs before freeing netdevs
CVE-2026-64588 7.8 HIGH fuse-uring: fix data races on ring->ready
CVE-2026-64584 7.8 HIGH usb: gadget: f_midi: cancel pending IN work before freeing the midi object
CVE-2026-64601 7.8 HIGH ALSA: us144mkii: capture_urb_complete: redundant usb_anchor_urb corrupts anchor list on ea
CVE-2026-64599 7.8 HIGH crypto: amlogic - avoid double cleanup in meson_crypto_probe()
CVE-2026-64587 7.0 HIGH net: ethernet: arc: emac: quiesce interrupts before requesting IRQ
CVE-2026-68480 x86/bugs: Make Safe-RET robust against interrupt injection
CVE-2026-64604 KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode
CVE-2026-64603 platform/x86: intel-hid: Protect ACPI notify handler against recursion
CVE-2026-64602 iio: adc: spear: Initialize completion before requesting IRQ
CVE-2026-64596 libfs: set SB_I_NOEXEC and SB_I_NODEV by default in init_pseudo()
CVE-2026-64595 HID: hid-lenovo-go: cancel cfg_setup work in hid_go_cfg_remove()
CVE-2026-64593 btrfs: do not trim a device which is not writeable
CVE-2026-64594 usb: gadget: f_fs: initialize reset_work at allocation time
CVE-2026-64592 riscv: mm: Unconditionally sfence.vma for spurious fault
CVE-2026-64591 iommu/vt-d: Avoid WARNING in sva unbind path
CVE-2026-64590 dma-buf/udmabuf: skip redundant cpu sync to fix cacheline EEXIST warning

Showing top 20 of 22 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-64583

No comments yet

Leave a comment