CVE-2026-89622

CVE-2026-89622 is a write use-after-free in the Linux kernel's HID mcp2221 driver. The function mcp_i2c_smbus_read() stores a caller-supplied buffer pointer in mcp->rxbuf for the duration of an I2C/SMBus transfer but never clears it on completion or timeout. Once the caller frees or reuses the...