CVE-2026-80826: Linux Kernel USB Use-After-Free Vulnerability

CVE-2026-80826 Overview

CVE-2026-80826 is a use-after-free vulnerability in the Linux kernel's USB c67x00 host controller driver. The flaw resides in the c67x00_add_iso_urb() function, which handles isochronous USB Request Blocks (URBs). When Transfer Descriptor (TD) creation fails for the last packet of an isochronous URB, the driver returns the URB before updating the endpoint scheduling state. Subsequent accesses to urbp->ep_data, urb->interval, and urbp->cnt then reference memory that the completion callback has already freed. The upstream patch reorders operations so next_frame and cnt update before the failed URB giveback.

Critical Impact
Use-after-free in the kernel USB stack can lead to memory corruption, kernel crashes, or potential privilege escalation on systems using the Cypress C67x00 USB host controller driver.

Affected Products

Linux kernel builds that include the USB c67x00 (Cypress CY7C67200) host controller driver
Multiple stable kernel branches referenced in the upstream fix commits
Distributions shipping the affected drivers/usb/c67x00/ subsystem prior to backport

Discovery Timeline

2026-09-04 - CVE-2026-80826 published to NVD
2026-09-04 - Last updated in NVD database

Technical Details for CVE-2026-80826

Vulnerability Analysis

The vulnerability affects isochronous URB scheduling in the Cypress C67x00 USB host controller driver. Isochronous transfers deliver time-sensitive data such as audio and video across USB. The driver builds a chain of Transfer Descriptors (TDs), one per packet, inside c67x00_add_iso_urb(). If TD allocation fails partway through the loop, the driver must clean up correctly.

When the failure occurs on the final packet, the driver calls c67x00_giveback_urb() before updating scheduling metadata. The giveback path frees the URB private data structure (urbp) and invokes the completion callback, which can drop the final reference to the URB itself. Code following the giveback then reads urbp->ep_data, urb->interval, and urbp->cnt from freed memory, producing classic use-after-free behavior.

Root Cause

The root cause is an ordering defect between resource release and state update. The failure-handling branch releases the URB before recording next_frame and cnt into the endpoint scheduling context. Because c67x00_giveback_urb() is a terminal operation on the URB and its private data, any subsequent field access is invalid.

Attack Vector

Triggering the flaw requires exercising the isochronous transfer path on hardware or emulation that uses the c67x00 driver, then inducing TD creation failure on the last packet. A local attacker or malicious USB device capable of shaping isochronous traffic could stress the allocator to reach the vulnerable path. Successful exploitation of a kernel use-after-free may result in denial of service or memory corruption that a skilled attacker could leverage for privilege escalation.

No public proof-of-concept exploit code is available for this issue. See the upstream commits for the technical fix, including Kernel Patch 62cd519 and Kernel Patch b1e24de.

Detection Methods for CVE-2026-80826

Indicators of Compromise

Kernel oops or panic messages referencing c67x00_add_iso_urb, c67x00_giveback_urb, or the drivers/usb/c67x00/ code path
KASAN (Kernel Address Sanitizer) reports flagging use-after-free reads on URB private data fields
Unexpected USB host controller resets or isochronous endpoint stalls on systems using Cypress C67x00 hardware

Detection Strategies

Enable KASAN on test kernels to surface use-after-free access to urbp->ep_data, urb->interval, and urbp->cnt
Audit installed kernel versions against the stable trees referenced in the upstream fix commits
Inventory hosts that load the c67x00 module using package management and lsmod telemetry

Monitoring Recommendations

Collect kernel ring buffer (dmesg) and journalctl -k output centrally to identify crash signatures tied to the USB stack
Track USB device attach and detach events on servers, industrial systems, and embedded devices where C67x00 controllers are used
Alert on repeated kernel warnings from the USB subsystem that could indicate driver instability or exploitation attempts

How to Mitigate CVE-2026-80826

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the NVD entry as soon as vendor builds are available
Prioritize patching for systems that expose USB ports to untrusted users or peripherals
Unload the c67x00 module on systems that do not require Cypress USB host controller functionality

Patch Information

The fix reorders operations in c67x00_add_iso_urb() so that next_frame and cnt are updated before the failing final-packet URB is given back. The giveback becomes the last operation to touch the URB and its private data, eliminating access to freed memory. The upstream commits include Kernel Patch 62cd519, Kernel Patch 7983daa, Kernel Patch ade18b4, Kernel Patch b1e24de, Kernel Patch b4cb808, Kernel Patch bb57280, Kernel Patch e4039e9, Kernel Patch f24dcc6, and Kernel Patch ff17209.

Workarounds

Blacklist the c67x00 kernel module on hosts that do not require the driver
Restrict physical access to USB ports on affected systems to reduce the risk of malicious peripheral attachment
Disable isochronous device classes such as USB audio and video on affected hosts when operationally acceptable

bash

# Blacklist the c67x00 driver until the patched kernel is deployed
echo 'blacklist c67x00' | sudo tee /etc/modprobe.d/blacklist-c67x00.conf
sudo rmmod c67x00 2>/dev/null || true
sudo update-initramfs -u