Vulnerability in ITE IT82xx2 USB Device-Controller Driver

CVE-2026-16147

What is CVE-2026-16147?

The ITE IT82xx2 USB device-controller driver mishandles multi-packet OUT transfers on non-control endpoints, leading to critical security issues. When a multi-packet transfer occurs, the driver fails to dequeue the current buffer properly, resulting in a use-after-free write condition. This flaw allows an untrusted USB host to potentially exploit the device, executing remote denial of service attacks or manipulating the memory region for malicious purposes. The vulnerability principally arises from dynamic memory management flaws, which lead to buffer reuse and corruption. A fix has been implemented to ensure the buffer is completely filled before submission to the upper stack, preventing multiple submissions and enhancing the robustness of the driver.

References