CVE-2026-80824: Linux Kernel USB Use-After-Free Vulnerability

CVE-2026-80824 Overview

CVE-2026-80824 is a use-after-free vulnerability in the Linux kernel's USB filesystem (usbfs) driver. The flaw resides in usbdev_release(), which drops its reference to the struct usb_device before draining the list of completed asynchronous URBs. The drain path then reads back through the freed object via free_async() and dec_usb_memory_use_count(), dereferencing ps->dev->bus after the device memory has been released.

An unprivileged local user with read/write access to a /dev/bus/usb node can trigger the condition reliably by mapping a URB buffer, waiting for device disconnect, then closing the file descriptor.

Critical Impact
Local unprivileged users can trigger kernel memory corruption through USB device disconnect handling, enabling potential privilege escalation or denial of service.

Affected Products

Linux kernel (multiple stable branches, per upstream fix commits)
Distributions shipping vulnerable usbfs implementations in drivers/usb/core/devio.c
Systems exposing /dev/bus/usb nodes to unprivileged users

Discovery Timeline

2026-09-04 - CVE-2026-80824 published to NVD
2026-09-04 - Last updated in NVD database

Technical Details for CVE-2026-80824

Vulnerability Analysis

The vulnerability is a use-after-free [CWE-416] in the Linux kernel's usbfs subsystem. When a userspace process closes its handle to a USB device node, usbdev_release() executes cleanup logic that includes releasing a reference to the underlying struct usb_device and draining any outstanding asynchronous URBs. The ordering of these two operations is incorrect.

usbdev_release() calls usb_put_dev() before iterating the completed async URB list. If the userspace reference was the last one holding the device alive, for example after the physical device has been unplugged, usb_put_dev() frees the device object. The subsequent drain loop then walks each URB and invokes free_async(), which calls dec_usb_memory_use_count(). That function begins with bus_to_hcd(ps->dev->bus), reading offset 80 of the already-freed usb_device allocation and treating the result as a struct usb_hcd *.

Root Cause

The root cause is an incorrect resource release order in drivers/usb/core/devio.c. Cleanup code released the usb_device reference before iterating structures that still depended on it. The upstream fix moves the usb_put_dev() call to run after the drain loop completes, so the device object remains valid throughout URB teardown.

Attack Vector

Exploitation requires local access and read/write permission on a /dev/bus/usb node. The attacker performs these steps: open the USB device file, mmap() the file descriptor, submit at least one URB whose buffer lives inside that mapping, wait for the device to be disconnected, then munmap() and close().

Because a live MAP_SHARED VMA holds a reference on the backing struct file, usbdev_release() cannot run until the last VMA is torn down. This guarantees the freeing branch of dec_usb_memory_use_count() is always taken, making the flaw reproducible rather than a race. Successful exploitation reads through freed slab memory that an attacker may control via heap grooming, potentially enabling privilege escalation or a kernel crash.

No verified public exploit code is available. See the upstream commits listed in the References section for the technical fix.

Detection Methods for CVE-2026-80824

Indicators of Compromise

KASAN reports of the form BUG: KASAN: slab-use-after-free in dec_usb_memory_use_count in kernel logs
Unexpected kernel oops or panic traces referencing usbdev_release, free_async, or hcd_buffer_free_pages
Repeated crashes correlated with USB device disconnect events on hosts exposing /dev/bus/usb to unprivileged users

Detection Strategies

Monitor dmesg and journalctl -k for slab-use-after-free warnings involving USB core symbols
Audit processes that open /dev/bus/usb/* nodes and issue USBDEVFS_SUBMITURB ioctls followed by mmap()
Correlate udev disconnect events with process crashes or kernel warnings to surface exploitation attempts

Monitoring Recommendations

Enable KASAN or KFENCE on kernels used for validation and canary hosts to catch exploitation in test environments
Forward kernel logs to a centralized logging platform and alert on KASAN, slab-use-after-free, and usbfs keyword matches
Track unusual usage patterns of /dev/bus/usb by non-root users, including short-lived processes issuing USB ioctls

How to Mitigate CVE-2026-80824

Immediate Actions Required

Apply the upstream kernel patches referenced in the git.kernel.org stable commits and rebuild or upgrade affected kernels
Track distribution advisories from Debian, Red Hat, SUSE, Ubuntu, and other vendors for backported fixes
Restrict access to /dev/bus/usb nodes so only trusted users and services can open them

Patch Information

The fix relocates the usb_put_dev() call in usbdev_release() to run after the async URB drain loop completes. Upstream commits include 0a960b88, 0dd68b5d, 47a7f98f, 5f08c45b, 65879e0a, 7f0278e4, 96f5520f, b3cde26a, and bd4bffc6.

Workarounds

Tighten udev rules and filesystem permissions on /dev/bus/usb/* so only privileged accounts can open USB device nodes
Remove users from groups such as plugdev that grant direct USB access on multi-user systems
Disable or unload USB host controller drivers on servers that do not need runtime USB device attachment

bash

# Restrict /dev/bus/usb access to root only via udev
# /etc/udev/rules.d/99-usbfs-restrict.rules
SUBSYSTEM=="usb", MODE="0600", OWNER="root", GROUP="root"

# Reload rules and re-trigger
sudo udevadm control --reload-rules
sudo udevadm trigger --subsystem-match=usb