CVE-2026-16148

The ITE it82xx2 USB device-controller driver initialized its bus-suspend detection work with kworkinitdelayable&priv-suspendedwork, suspendedhandler inside it82xx2enable the driver's .enable op in drivers/usb/udc/udcit82xx2.c. This work item is scheduled essentially continuously while the USB bus...

CVE-2026-16148

CVE-2026-16148 affects the ITE it82xx2 USB device-controller driver in Zephyr RTOS (drivers/usb/udc/udc_it82xx2.c). The root cause is that k_work_init_delayable() is called inside it82xx2_enable(), which unconditionally overwrites the delayable work structure without a busy check . Because it82xx...

EUVD-2026-77778

The ITE it82xx2 USB device-controller driver initialized its bus-suspend detection work with kworkinitdelayable&priv-suspendedwork, suspendedhandler inside it82xx2enable the driver's .enable op in drivers/usb/udc/udcit82xx2.c. This work item is scheduled essentially continuously while the USB bus...

CVE-2026-16147 it82xx2 USB device controller submits incomplete OUT transfer buffers, causing use-after-free and event-list corruption

The ITE IT82xx2 USB device-controller driver drivers/usb/udc/udcit82xx2.c mishandles multi-packet OUT transfers on non-control endpoints. In workhandlerout the active transfer buffer is obtained with udcbufpeek which does not dequeue it; when a full max-packet-size packet arrives but the buffer...

EUVD-2026-77777

The ITE IT82xx2 USB device-controller driver drivers/usb/udc/udcit82xx2.c mishandles multi-packet OUT transfers on non-control endpoints. In workhandlerout the active transfer buffer is obtained with udcbufpeek which does not dequeue it; when a full max-packet-size packet arrives but the buffer...

Astra Linux – Vulnerability in Linux, Linux 5.10

In the drivers/usb/gadget/udc/udc-xilinx.c file within the Linux kernel, before version 5.16.12, the endpoint index was not validated, and it could be manipulated by the host for out-of-array access...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: usb: udc: remove warning when queue disabled ep It is possible for this issue to occur when the mass storage function tries to queue requests from the main thread. However, other threads may already disable the endpoint when the...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: USB: bcm63xxudc: fixed a memory leak that occurred when using debugfslookup. When calling debugfslookup, the result must be processed by calling dput; otherwise, a memory leak will occur over time. To simplify things, simply call...

Linux Distros Unpatched Vulnerability : CVE-2026-89738

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - usb: gadget: at91udc: drain polled-VBUS timer/work before udc is freed In polled-VBUS mode board.vbuspin && board.vbuspolled, probe arms a self-restarting cycle...

CVE-2026-89738 usb: gadget: at91_udc: drain polled-VBUS timer/work before udc is freed

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: at91udc: drain polled-VBUS timer/work before udc is freed In polled-VBUS mode board.vbuspin && board.vbuspolled, probe arms a self-restarting cycle: at91vbustimer schedules vbustimerwork, and at91vbustimerwork calls...

PT-2026-90454

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: at91 udc: drain polled-VBUS timer/work before udc is freed In polled-VBUS mode board.vbus pin && board.vbus polled, probe arms a self-restarting cycle: at91 vbus timer schedules vbus timer work, and at91 vbus timer...

The vulnerability of the `__acquires()` function in the drivers/usb/chipidea/udc.c module of the Linux operating system’s USB device driver framework allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the acquires function in the drivers/usb/chipidea/udc.c module of the Linux device driver framework is related to the execution of operations outside of the buffer in memory. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, a...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: USB: dummy-hcd: Fixed interrupt synchronization error This fixes an error in synchronization within the dummy-hcd driver. The error has a somewhat complex history. The synchronization mechanism was introduced in commit...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: USB: Gadget: pxa25xudc: fixed a memory leak that occurred when using debugfslookup. When calling debugfslookup, the result must be processed by calling dput; otherwise, a memory leak will occur over time. To simplify things, simp...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: USB: Gadget: lpc32xxudc – a memory leak was fixed by using debugfslookup. When calling debugfslookup, the result must be processed with dput, otherwise a memory leak will occur over time. To simplify things, simply call...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: USB: Gadget: Fixed a use-after-free bug by not setting udc-dev.driver. The syzbot fuzzer identified a use-after-free bug: BUG: KASAN: Use-after-free in devuevent+0x712/0x780 drivers/base/core.c:2320. A memory read of size 8 at...

The vulnerability of the `usb_gadget_state_work()` function in the `/drivers/usb/gadget/udc/core.c` file of the Linux kernel allows a hacker to induce a service failure.

The vulnerability of the usbgadgetstatework function in the /drivers/usb/gadget/udc/core.c file of the Linux kernel is related to situations where the signal processing routine is involved in a race condition. Exploiting this vulnerability could allow an attacker to cause a service failure...

CVE-2026-64583

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: udc: bdc: free IRQ and drain funcwakenotify before teardown The Broadcom BDC UDC driver registers its IRQ handler with devmrequestirq in bdcudcinit, so the IRQ is released by devm only after bdcremove returns. devm...

CVE-2026-64583

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: udc: bdc: free IRQ and drain funcwakenotify before teardown The Broadcom BDC UDC driver registers its IRQ handler with devmrequestirq in bdcudcinit, so the IRQ is released by devm only after bdcremove returns. devm...

CVE-2026-64583 usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: udc: bdc: free IRQ and drain funcwakenotify before teardown The Broadcom BDC UDC driver registers its IRQ handler with devmrequestirq in bdcudcinit, so the IRQ is released by devm only after bdcremove returns. devm...