CVE-2026-64583 Overview
CVE-2026-64583 is a use-after-free vulnerability in the Linux kernel's Broadcom BDC USB Device Controller (UDC) gadget driver. The flaw resides in the driver's teardown sequence, where the IRQ handler and a delayed work item remain active while endpoint structures and DMA-coherent memory are freed. A shared interrupt or queued work callback firing in this window dereferences freed or NULL memory in bdc_udc_interrupt() and bdc_func_wake_timer(). The issue was identified by an in-house static analysis tool and resolved through commits to the mainline and stable Linux kernel trees.
Critical Impact
A race between IRQ delivery, delayed work execution, and driver removal can cause NULL-pointer dereference or use-after-free in kernel context, resulting in kernel memory corruption or denial of service.
Affected Products
- Linux kernel usb/gadget/udc/bdc driver (Broadcom BDC UDC)
- Kernel builds using devm_request_irq() in bdc_udc_init() without matching cancellation of func_wake_notify delayed work
- Systems running SoCs with the Broadcom BDC USB device controller
Discovery Timeline
- 2026-08-06 - CVE-2026-64583 published to NVD
- 2026-08-06 - Last updated in NVD database
Technical Details for CVE-2026-64583
Vulnerability Analysis
The Broadcom BDC UDC driver registers its shared IRQ handler with devm_request_irq() inside bdc_udc_init(). Because devm-managed resources are released in reverse LIFO order only after bdc_remove() returns, the IRQ remains live while bdc_remove() manually tears down driver state. During removal, bdc_udc_exit() frees per-endpoint objects through bdc_free_ep(), and bdc_hw_exit() calls bdc_mem_free(), which frees and NULLs the DMA-coherent status-report ring bdc->srr.sr_bds and kfree()s bdc->bdc_ep_array.
If a shared interrupt arrives in this window, bdc_udc_interrupt() dereferences bdc->srr.sr_bds[bdc->srr.dqp_index], which now points to freed or NULL DMA memory. The handler then dispatches sr_handler callbacks that index into the freed bdc_ep_array, producing a NULL-pointer dereference or use-after-free in kernel context.
Root Cause
The root cause is incorrect teardown ordering combined with missing cancellation of asynchronous work. The func_wake_notify delayed work is scheduled from bdc_sr_uspc() through handle_link_state_change() and can self-rearm via bdc_func_wake_timer(). The driver contains no cancel_delayed_work_sync() call, so a queued work item may fire after bdc_remove() returns and the bdc structure has been devm-freed.
Attack Vector
Triggering the flaw requires the driver to be unbound or the device to be removed while USB gadget activity generates shared interrupts or link-state work. The vulnerability is local and dependent on system state during module unload or hot-unplug. See the upstream patches for the exact fix: Kernel commit 0583f2fbf8f8 and Kernel commit dcf3e2f16443.
No verified exploit code is available. The fix replaces devm_request_irq() with request_irq(), clears BDC_GIE, calls free_irq(bdc->irq, bdc) explicitly, and then invokes cancel_delayed_work_sync() before endpoint and DMA teardown.
Detection Methods for CVE-2026-64583
Indicators of Compromise
- Kernel oops or panic traces referencing bdc_udc_interrupt, bdc_sr_uspc, handle_link_state_change, or bdc_func_wake_timer during driver unbind or device removal
- KASAN reports flagging use-after-free on bdc->srr.sr_bds or bdc->bdc_ep_array
- NULL-pointer dereferences correlated with USB gadget module unload events
Detection Strategies
- Enable KASAN and KFENCE on test kernels running the BDC UDC driver to surface use-after-free conditions during driver teardown scenarios
- Correlate dmesg output and kernel crash dumps with USB device unbind or hot-unplug operations affecting BDC-based hardware
- Audit kernel version and vendor backport status against the fix commits listed in the NVD entry
Monitoring Recommendations
- Ship kernel logs to a centralized logging pipeline and alert on BUG:, Oops:, or KASAN: entries referencing the bdc driver
- Track USB gadget module load and unload events on affected hardware to identify exposure windows
- Monitor for unexpected reboots or kernel panics on embedded systems that use Broadcom BDC USB controllers
How to Mitigate CVE-2026-64583
Immediate Actions Required
- Apply the upstream Linux kernel patches referenced in the NVD entry to affected kernel branches
- Rebuild and redeploy kernels for systems using the BDC UDC driver, prioritizing embedded and SoC platforms
- Restrict privileged access to USB gadget subsystem operations such as module load, unload, and driver bind or unbind
Patch Information
The fix is available in multiple stable kernel branches. Relevant commits: 0583f2fbf8f8, 1a1d7158420d, d4964a747171, dcf3e2f16443, and f6fc21ec7ccd. The patch replaces devm_request_irq() with request_irq(), clears the BDC_GIE interrupt-enable bit before releasing the IRQ, drains in-flight handlers via free_irq(), and cancels func_wake_notify with cancel_delayed_work_sync() prior to endpoint and DMA teardown.
Workarounds
- Avoid unbinding or unloading the bdc driver on production systems running unpatched kernels
- Where feasible, disable the BDC UDC driver in kernel configuration on systems that do not require USB gadget functionality
- Isolate affected embedded devices from untrusted local users who could trigger module unload paths
# Verify BDC UDC driver presence and kernel version before patching
uname -r
modinfo bdc_udc 2>/dev/null | grep -E 'filename|version|srcversion'
# Optionally blacklist the driver on systems that do not need USB gadget support
echo 'blacklist bdc_udc' | sudo tee /etc/modprobe.d/blacklist-bdc.conf
sudo update-initramfs -u
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
