SB20260824172 - Use-after-free in Linux kernel usb usx2y

Description

This security bulletin contains information about 1 vulnerability.

1) Use-after-free (CVE-ID: CVE-2026-74639)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to execute arbitrary code or cause a denial of service.

The vulnerability exists due to a use-after-free in capture_urb_complete() and the capture URB anchoring logic when resubmitting capture URBs from their completion handler. A local user can trigger capture URB resubmission and subsequent device disconnect, suspend, or stop-work handling to execute arbitrary code or cause a denial of service.

The issue occurs because resubmitted URBs are no longer tracked by the anchor, allowing queued URBs to complete after the transfer buffers and driver object have been freed.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/2615f0fb90df8cf5a96133ca4be74294ed288604
• https://git.kernel.org/stable/c/7779249561d14b8a17c0c83783225794e24a587d
• https://git.kernel.org/stable/c/a5548ce916594c811bd90ce33d67baa3557a6791