{"id":"CVE-2026-80826","summary":"USB: c67x00: fix use-after-free in c67x00_add_iso_urb()","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: c67x00: fix use-after-free in c67x00_add_iso_urb()\n\nWhen TD creation fails for the last packet of an isochronous URB,\nc67x00_add_iso_urb() gives the URB back before updating the endpoint\nscheduling state.\n\nc67x00_giveback_urb() frees the URB private data, and the completion\ncallback may release the final URB reference. The following accesses to\nurbp-\u003eep_data, urb-\u003einterval, and urbp-\u003ecnt can therefore use freed\nmemory.\n\nUpdate next_frame and cnt before giving back the failed final packet,\nmaking the giveback the last operation that uses the URB and its private\ndata.","modified":"2026-09-06T03:46:52.346307064Z","published":"2026-09-04T15:54:30.131Z","database_specific":{"cna_assigner":"Linux","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/80xxx/CVE-2026-80826.json"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/62cd519ab74cac499036cd88c11692f8f0d53e14"},{"type":"WEB","url":"https://git.kernel.org/stable/c/7983daa159981fac125db2457437723f38ea1472"},{"type":"WEB","url":"https://git.kernel.org/stable/c/ade18b4ce78a16558f4f435aece80082f6f7b64c"},{"type":"WEB","url":"https://git.kernel.org/stable/c/b1e24de475bf2d66fffc9103f3444b783527d55a"},{"type":"WEB","url":"https://git.kernel.org/stable/c/b4cb8081cf80f82e48fbe9c021a8f6d0fa2ed421"},{"type":"WEB","url":"https://git.kernel.org/stable/c/bb572801290e25ec1c4753d14af35777303f5d6b"},{"type":"WEB","url":"https://git.kernel.org/stable/c/e4039e9bebb528dd9cd7ac72aeaec529c26c355a"},{"type":"WEB","url":"https://git.kernel.org/stable/c/f24dcc61bd0ecf7639fac5bf700450b398d793a7"},{"type":"WEB","url":"https://git.kernel.org/stable/c/ff172092cba7ec990ecc7b610ce703e19570b8f0"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/80xxx/CVE-2026-80826.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80826"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"e9b29ffc519b9e63d4e1c0b1278bb951bb418a9d"},{"fixed":"e4039e9bebb528dd9cd7ac72aeaec529c26c355a"},{"fixed":"ade18b4ce78a16558f4f435aece80082f6f7b64c"},{"fixed":"bb572801290e25ec1c4753d14af35777303f5d6b"},{"fixed":"62cd519ab74cac499036cd88c11692f8f0d53e14"},{"fixed":"ff172092cba7ec990ecc7b610ce703e19570b8f0"},{"fixed":"b4cb8081cf80f82e48fbe9c021a8f6d0fa2ed421"},{"fixed":"7983daa159981fac125db2457437723f38ea1472"},{"fixed":"f24dcc61bd0ecf7639fac5bf700450b398d793a7"},{"fixed":"b1e24de475bf2d66fffc9103f3444b783527d55a"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-80826.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.6.26"},{"fixed":"5.10.269"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.11.0"},{"fixed":"5.15.220"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.16.0"},{"fixed":"6.1.187"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.2.0"},{"fixed":"6.6.156"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0"},{"fixed":"6.12.108"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.49"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"7.1.13"}]},{"type":"ECOSYSTEM","events":[{"introduced":"7.2.0"},{"fixed":"7.2.3"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-80826.json"}}],"schema_version":"1.9.0"}