Use-After-Free Vulnerability in Linux Kernel Affecting USB Device Management

CVE-2026-80824

What is CVE-2026-80824?

A use-after-free vulnerability exists in the Linux kernel's USB device management when handling the usb_device structure. In the process of releasing a USB device reference, the kernel drops the reference before completely draining the list of completed asynchronous requests (URBs). This creates a scenario where an unprivileged attacker can exploit the race condition by interacting with a USB device, leading to potential read from freed memory. Such exploitation may allow attackers to execute arbitrary code or cause system instability. It is crucial for users and administrators to apply updates and patches to the Linux kernel promptly to mitigate the risks associated with this vulnerability.

References