{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-80826","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2026-08-26T14:34:25.795Z","datePublished":"2026-09-04T15:54:30.131Z","dateUpdated":"2026-09-04T15:54:30.131Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-09-04T15:54:30.131Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: c67x00: fix use-after-free in c67x00_add_iso_urb()\n\nWhen TD creation fails for the last packet of an isochronous URB,\nc67x00_add_iso_urb() gives the URB back before updating the endpoint\nscheduling state.\n\nc67x00_giveback_urb() frees the URB private data, and the completion\ncallback may release the final URB reference. The following accesses to\nurbp->ep_data, urb->interval, and urbp->cnt can therefore use freed\nmemory.\n\nUpdate next_frame and cnt before giving back the failed final packet,\nmaking the giveback the last operation that uses the URB and its private\ndata."}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/usb/c67x00/c67x00-sched.c"],"versions":[{"version":"e9b29ffc519b9e63d4e1c0b1278bb951bb418a9d","lessThan":"e4039e9bebb528dd9cd7ac72aeaec529c26c355a","status":"affected","versionType":"git"},{"version":"e9b29ffc519b9e63d4e1c0b1278bb951bb418a9d","lessThan":"ade18b4ce78a16558f4f435aece80082f6f7b64c","status":"affected","versionType":"git"},{"version":"e9b29ffc519b9e63d4e1c0b1278bb951bb418a9d","lessThan":"bb572801290e25ec1c4753d14af35777303f5d6b","status":"affected","versionType":"git"},{"version":"e9b29ffc519b9e63d4e1c0b1278bb951bb418a9d","lessThan":"62cd519ab74cac499036cd88c11692f8f0d53e14","status":"affected","versionType":"git"},{"version":"e9b29ffc519b9e63d4e1c0b1278bb951bb418a9d","lessThan":"ff172092cba7ec990ecc7b610ce703e19570b8f0","status":"affected","versionType":"git"},{"version":"e9b29ffc519b9e63d4e1c0b1278bb951bb418a9d","lessThan":"b4cb8081cf80f82e48fbe9c021a8f6d0fa2ed421","status":"affected","versionType":"git"},{"version":"e9b29ffc519b9e63d4e1c0b1278bb951bb418a9d","lessThan":"7983daa159981fac125db2457437723f38ea1472","status":"affected","versionType":"git"},{"version":"e9b29ffc519b9e63d4e1c0b1278bb951bb418a9d","lessThan":"f24dcc61bd0ecf7639fac5bf700450b398d793a7","status":"affected","versionType":"git"},{"version":"e9b29ffc519b9e63d4e1c0b1278bb951bb418a9d","lessThan":"b1e24de475bf2d66fffc9103f3444b783527d55a","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/usb/c67x00/c67x00-sched.c"],"versions":[{"version":"2.6.26","status":"affected"},{"version":"0","lessThan":"2.6.26","status":"unaffected","versionType":"semver"},{"version":"5.10.269","lessThanOrEqual":"5.10.*","status":"unaffected","versionType":"semver"},{"version":"5.15.220","lessThanOrEqual":"5.15.*","status":"unaffected","versionType":"semver"},{"version":"6.1.187","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.6.156","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.12.108","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.18.49","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"7.1.13","lessThanOrEqual":"7.1.*","status":"unaffected","versionType":"semver"},{"version":"7.2.3","lessThanOrEqual":"7.2.*","status":"unaffected","versionType":"semver"},{"version":"7.3-rc1","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.26","versionEndExcluding":"5.10.269"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.26","versionEndExcluding":"5.15.220"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.26","versionEndExcluding":"6.1.187"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.26","versionEndExcluding":"6.6.156"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.26","versionEndExcluding":"6.12.108"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.26","versionEndExcluding":"6.18.49"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.26","versionEndExcluding":"7.1.13"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.26","versionEndExcluding":"7.2.3"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.26","versionEndExcluding":"7.3-rc1"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/e4039e9bebb528dd9cd7ac72aeaec529c26c355a"},{"url":"https://git.kernel.org/stable/c/ade18b4ce78a16558f4f435aece80082f6f7b64c"},{"url":"https://git.kernel.org/stable/c/bb572801290e25ec1c4753d14af35777303f5d6b"},{"url":"https://git.kernel.org/stable/c/62cd519ab74cac499036cd88c11692f8f0d53e14"},{"url":"https://git.kernel.org/stable/c/ff172092cba7ec990ecc7b610ce703e19570b8f0"},{"url":"https://git.kernel.org/stable/c/b4cb8081cf80f82e48fbe9c021a8f6d0fa2ed421"},{"url":"https://git.kernel.org/stable/c/7983daa159981fac125db2457437723f38ea1472"},{"url":"https://git.kernel.org/stable/c/f24dcc61bd0ecf7639fac5bf700450b398d793a7"},{"url":"https://git.kernel.org/stable/c/b1e24de475bf2d66fffc9103f3444b783527d55a"}],"title":"USB: c67x00: fix use-after-free in c67x00_add_iso_urb()","x_generator":{"engine":"bippy-1.2.0"}}}}