CVE-2026-89622: Linux Kernel HID mcp2221 Use-After-Free

CVE-2026-89622 Overview

CVE-2026-89622 is a use-after-free vulnerability in the Linux kernel's HID mcp2221 driver, which handles Microchip MCP2221 USB-to-I2C/SMBus bridge devices. The mcp_i2c_smbus_read() function stores a caller-supplied buffer pointer in mcp->rxbuf for the duration of a transfer but fails to clear it when the transfer finishes or times out. A delayed or spurious MCP2221_I2C_GET_DATA report can then trigger mcp2221_raw_event() to write device data into freed memory. The flaw allows local attackers with low privileges to corrupt kernel memory, potentially leading to privilege escalation or denial of service.

Critical Impact
A local attacker with the ability to interact with an MCP2221 device can trigger a kernel write use-after-free, undermining confidentiality, integrity, and availability of the affected system.

Affected Products

Linux kernel versions containing the vulnerable drivers/hid/hid-mcp2221.c implementation prior to the fix
Systems using the Microchip MCP2221/MCP2221A USB-to-I2C/SMBus bridge with the in-tree HID driver
Stable kernel branches patched via commits 03c34309, 968546b6, and db2333f8

Discovery Timeline

2026-09-11 - CVE-2026-89622 published to NVD
2026-09-13 - Last updated in NVD database

Technical Details for CVE-2026-89622

Vulnerability Analysis

The mcp2221 driver mediates I2C and SMBus transactions between userspace and a USB-attached MCP2221 bridge chip. During a read operation, mcp_i2c_smbus_read() writes the caller-supplied output buffer pointer into the driver-private mcp->rxbuf field. The device then asynchronously delivers data via HID reports, which mcp2221_raw_event() copies into mcp->rxbuf using memcpy.

The vulnerability arises because the driver never clears mcp->rxbuf when the transfer completes normally or times out. Once the caller returns and frees or reuses the buffer, mcp->rxbuf becomes a dangling pointer. Any subsequent, delayed, or spurious MCP2221_I2C_GET_DATA report causes the raw event handler to write attacker-influenced data into freed kernel memory, producing a write use-after-free condition.

Root Cause

The root cause is missing state cleanup on the completion and error paths of mcp_i2c_smbus_read(). The !mcp->rxbuf guard already present in mcp2221_raw_event() was intended to reject reports arriving after a transfer ends, but it never engages because rxbuf is left populated. The fix routes all return paths through a single exit point that clears both mcp->rxbuf and mcp->rxbuf_size, restoring the guard's effectiveness.

Attack Vector

Exploitation requires local access with sufficient privileges to interact with an attached MCP2221 device or to influence USB HID reports delivered to the driver. An attacker capable of racing a legitimate transfer completion with a delayed or crafted MCP2221_I2C_GET_DATA report can direct the kernel to write device-controlled bytes into freed memory. Depending on heap layout and adjacent allocations, this write primitive can be shaped into privilege escalation or reliable denial of service.

No public proof-of-concept exploit is available. Refer to the upstream kernel commits 03c34309, 968546b6, and db2333f8 for technical details of the fix.

Detection Methods for CVE-2026-89622

Indicators of Compromise

Unexpected kernel oops, general protection faults, or KASAN use-after-free reports referencing mcp2221_raw_event or mcp_i2c_smbus_read in stack traces.
Kernel log entries showing MCP2221 I2C/SMBus transfer timeouts followed by memory corruption warnings.
Anomalous USB HID activity from devices claiming the MCP2221 vendor/product identifiers on systems that do not normally use such hardware.

Detection Strategies

Enable KASAN (Kernel Address Sanitizer) on test and staging kernels to catch use-after-free writes originating in the hid-mcp2221 driver.
Audit installed kernel packages against distribution advisories that reference the patch commits 03c34309, 968546b6, or db2333f8.
Monitor loaded kernel modules for hid-mcp2221 on systems where the driver is not required and flag its presence for review.

Monitoring Recommendations

Forward dmesg and journald kernel messages to a centralized logging platform and alert on crashes containing mcp2221 symbols.
Track USB device connection events via udev or auditd rules to detect unauthorized MCP2221 device attachment.
Correlate kernel crash telemetry with local user session activity to identify attempts to trigger the flaw.

How to Mitigate CVE-2026-89622

Immediate Actions Required

Apply the vendor-supplied kernel update containing the upstream fix as soon as it is available for your distribution.
On systems that do not require MCP2221 hardware support, blacklist the hid-mcp2221 module to eliminate exposure.
Restrict physical and remote access to USB ports on systems where the driver must remain loaded.

Patch Information

The fix is delivered via the Linux stable tree in commits 03c34309, 968546b6, and db2333f8. The patch routes all return paths in mcp_i2c_smbus_read() through a single exit that clears mcp->rxbuf and mcp->rxbuf_size, enabling the existing !mcp->rxbuf guard in mcp2221_raw_event() to reject late reports.

Workarounds

Blacklist the hid-mcp2221 module via /etc/modprobe.d/ and rebuild the initramfs on hosts that do not require the device.
Disable USB HID device access for untrusted users through udev rules or USB port lockdown policies.
Use USB device authorization controls to permit only known, trusted vendor/product identifiers to bind to kernel drivers.

bash

# Configuration example
# Prevent the vulnerable driver from loading
echo "blacklist hid-mcp2221" | sudo tee /etc/modprobe.d/blacklist-mcp2221.conf
sudo update-initramfs -u

# Verify the module is not currently loaded
lsmod | grep hid_mcp2221

# If loaded, unload it (ensure no dependent devices are in use)
sudo modprobe -r hid_mcp2221