Device Driver Vulnerability in Broadcom BDC UDC for Linux Kernel

CVE-2026-64583

What is CVE-2026-64583?

The Broadcom BDC UDC driver in the Linux kernel contains a vulnerability that stems from improper handling of interrupt requests (IRQs). The issue arises during the teardown process, where the IRQ handler remains deliverable while memory resources are being freed. This can result in a NULL dereference or use-after-free scenario, particularly when shared interrupts are received after the device has been removed, leading to potential system crashes or exploitable conditions. To mitigate this, the driver should implement a proper sequence for IRQ management, ensuring that all pending interrupts and delayed work items are canceled before freeing resources.

References