CVE-2026-16148: Operation on Resource in Wrong Phase of Lifetime

The ITE it82xx2 USB device-controller driver initialized its bus-suspend detection work with kworkinitdelayable&priv-suspendedwork, suspendedhandler inside it82xx2enable the driver's .enable op in drivers/usb/udc/udcit82xx2.c. This work item is scheduled essentially continuously while the USB bus...

CVE-2026-16147: Use After Free

The ITE IT82xx2 USB device-controller driver drivers/usb/udc/udcit82xx2.c mishandles multi-packet OUT transfers on non-control endpoints. In workhandlerout the active transfer buffer is obtained with udcbufpeek which does not dequeue it; when a full max-packet-size packet arrives but the buffer...

CVE-2026-10656: NULL Pointer Dereference

The MAX32xxx USB device controller driver drivers/usb/udc/udcmax32.c, compatible adimax32usbhs dereferenced an endpoint buffer in its OUT and IN transfer-completion handlers without checking it for NULL. udceventxferoutdone called netbufaddbuf, eprequest-actlen immediately after buf =...