---
id: CVE-2026-80824
title: 'usb: usbfs: fix use-after-free of usb_device in usbdev_release()'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  usb: usbfs: fix use-after-free of usb_device in usbdev_release()

  usbdev_release() drops its reference to the struct usb_device before
  draining the list of completed as…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= f7d34b445abc00e979b7cf36b9580ac3d1a47cd8 <
    0a960b88c5979f853019d4dc4957dfbeeb193440
  - >-
    Linux >= f7d34b445abc00e979b7cf36b9580ac3d1a47cd8 <
    96f5520fc9a5e4bbf77ac93c9d5ce502f597e6cf
  - >-
    Linux >= f7d34b445abc00e979b7cf36b9580ac3d1a47cd8 <
    bd4bffc621a8cb2f4d9ed9b6447415de524a3bef
  - >-
    Linux >= f7d34b445abc00e979b7cf36b9580ac3d1a47cd8 <
    65879e0a452ca2a234b9475e0c11aff7a4343738
  - >-
    Linux >= f7d34b445abc00e979b7cf36b9580ac3d1a47cd8 <
    b3cde26a66b04f1d90ed0b675899c88b4e49d424
  - >-
    Linux >= f7d34b445abc00e979b7cf36b9580ac3d1a47cd8 <
    5f08c45bdcfd28d1171de38c5ef29fc89a76eedc
  - >-
    Linux >= f7d34b445abc00e979b7cf36b9580ac3d1a47cd8 <
    7f0278e474c4d1c4457974ff1137cc385c944ab3
  - >-
    Linux >= f7d34b445abc00e979b7cf36b9580ac3d1a47cd8 <
    47a7f98fbb5006d46d15a3a210ffdc61448a4f19
  - >-
    Linux >= f7d34b445abc00e979b7cf36b9580ac3d1a47cd8 <
    0dd68b5d01d022fc9c5e71c82a82b0a94d3d0671
  - Linux 4.6
published: '2026-09-04'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T08:44:16.840Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-80824'
references:
  - url: 'https://git.kernel.org/stable/c/0a960b88c5979f853019d4dc4957dfbeeb193440'
  - url: 'https://git.kernel.org/stable/c/96f5520fc9a5e4bbf77ac93c9d5ce502f597e6cf'
  - url: 'https://git.kernel.org/stable/c/bd4bffc621a8cb2f4d9ed9b6447415de524a3bef'
  - url: 'https://git.kernel.org/stable/c/65879e0a452ca2a234b9475e0c11aff7a4343738'
  - url: 'https://git.kernel.org/stable/c/b3cde26a66b04f1d90ed0b675899c88b4e49d424'
  - url: 'https://git.kernel.org/stable/c/5f08c45bdcfd28d1171de38c5ef29fc89a76eedc'
  - url: 'https://git.kernel.org/stable/c/7f0278e474c4d1c4457974ff1137cc385c944ab3'
  - url: 'https://git.kernel.org/stable/c/47a7f98fbb5006d46d15a3a210ffdc61448a4f19'
  - url: 'https://git.kernel.org/stable/c/0dd68b5d01d022fc9c5e71c82a82b0a94d3d0671'
tags:
  - cve.org
epss: 0.00195
epssPercentile: 0.08587
ingestedAt: '2026-10-19T09:16:01.506Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

usb: usbfs: fix use-after-free of usb_device in usbdev_release()

usbdev_release() drops its reference to the struct usb_device before
draining the list of completed async URBs, but that drain path reads back
through the same object: free_async() calls dec_usb_memory_use_count()
for any URB whose buffer came from the usbfs mmap() region, and its first
statement is bus_to_hcd(ps->dev->bus).

After a disconnect the usbfs reference can be the last one, in which case
usb_put_dev() frees the device and the subsequent loop reads offset 80 of
freed memory and uses the result as a struct usb_hcd *, which
hcd_buffer_free_pages() then dereferences.

This is reachable by an unprivileged process that has read/write access to
a /dev/bus/usb node: mmap() the fd, submit one URB with a buffer inside the
mapping, wait for the device to be unplugged, then munmap() and close().
It reproduces on every attempt rather than being a race, because a live
MAP_SHARED vma holds a reference on the struct file, so usbdev_release()
cannot run until the last vma is gone and the freeing branch of
dec_usb_memory_use_count() is always taken.

  BUG: KASAN: slab-use-after-free in dec_usb_memory_use_count+0x3ae/0x410
  Read of size 8 at addr ffff8880122ee050 by task poc/769
  CPU: 1 UID: 1000 PID: 769 Comm: poc Tainted: G    B    6.12.94 #3

  Call Trace:
   dec_usb_memory_use_count+0x3ae/0x410
   free_async+0x2aa/0x4f0
   usbdev_release+0x375/0x460
   __fput+0x3ea/0xb50
   __x64_sys_close+0x86/0x100

  Allocated by task 11:
   usb_alloc_dev+0x55/0xd90
   hub_event+0x2524/0x43d0

  Freed by task 769:
   kfree+0x121/0x360
   device_release+0xd2/0x280
   usb_put_dev+0x23/0x30
   usbdev_release+0x2d8/0x460

Release the device reference after the drain loop instead. Nothing between
the two points requires it to have been dropped.

## Affected

- `Linux >= f7d34b445abc00e979b7cf36b9580ac3d1a47cd8 < 0a960b88c5979f853019d4dc4957dfbeeb193440`
- `Linux >= f7d34b445abc00e979b7cf36b9580ac3d1a47cd8 < 96f5520fc9a5e4bbf77ac93c9d5ce502f597e6cf`
- `Linux >= f7d34b445abc00e979b7cf36b9580ac3d1a47cd8 < bd4bffc621a8cb2f4d9ed9b6447415de524a3bef`
- `Linux >= f7d34b445abc00e979b7cf36b9580ac3d1a47cd8 < 65879e0a452ca2a234b9475e0c11aff7a4343738`
- `Linux >= f7d34b445abc00e979b7cf36b9580ac3d1a47cd8 < b3cde26a66b04f1d90ed0b675899c88b4e49d424`
- `Linux >= f7d34b445abc00e979b7cf36b9580ac3d1a47cd8 < 5f08c45bdcfd28d1171de38c5ef29fc89a76eedc`
- `Linux >= f7d34b445abc00e979b7cf36b9580ac3d1a47cd8 < 7f0278e474c4d1c4457974ff1137cc385c944ab3`
- `Linux >= f7d34b445abc00e979b7cf36b9580ac3d1a47cd8 < 47a7f98fbb5006d46d15a3a210ffdc61448a4f19`
- `Linux >= f7d34b445abc00e979b7cf36b9580ac3d1a47cd8 < 0dd68b5d01d022fc9c5e71c82a82b0a94d3d0671`
- `Linux 4.6`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.