Linux Kernel BDC UDC Driver Tears Down Endpoint Objects Before Releasing Its Interrupt Handler, Creating a Use-After-Free Window on Disconnect

Status: NEW  |  Advisory ID: CVE-2026-64583

Key Details

What to Know

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown

The Broadcom BDC UDC driver registers its IRQ handler with

devm_request_irq() in bdc_udc_init(), so the IRQ is released by devm

only after bdc_remove() returns. devm releases resources in reverse

LIFO order, but bdc_remove() runs bdc_udc_exit() and bdc_hw_exit() ->

bdc_mem_free() manually before returning: bdc_udc_exit() tears down

individual endpoint objects via bdc_free_ep(), while bdc_hw_exit() ->

bdc_mem_free() frees and NULLs the DMA-coherent status-report ring

(bdc->srr.sr_bds) and kfree()s bdc->bdc_ep_array. Both happen while

the IRQ handler (bdc_udc_interrupt, requested with IRQF_SHARED)

remains deliverable in the window up to the post-remove devm

free_irq().

On receipt of a shared interrupt in that window, bdc_udc_interrupt()

dereferences bdc->srr.sr_bds[bdc->srr.dqp_index] (NULL or freed DMA)

and dispatches sr_handler callbacks that index into bdc_ep_array,

causing a NULL-deref or use-after-free.

The same window affects the delayed_work bdc->func_wake_notify, which is

armed from the IRQ handler via bdc_sr_uspc() -> handle_link_state_change()

-> schedule_delayed_work() and may self-rearm from its own callback

bdc_func_wake_timer(). No cancel exists anywhere in the driver, so a

queued work item that fires after bdc_remove() returns and the bdc

structure is devm-freed dereferences freed memory.

Replace devm_request_irq() with request_irq() and add an explicit

free_irq(bdc->irq, bdc) in bdc_remove(). Clear BDC_GIE before

free_irq() to stop the device from asserting interrupts, then

free_irq() drains any in-flight handler, then cancel_delayed_work_sync()

drains the func_wake_notify delayed work. This ordering ensures the

IRQ handler and delayed work cannot interfere with the subsequent

endpoint and DMA teardown in bdc_udc_exit() and bdc_hw_exit(). Wire the

matching free_irq() into the bdc_udc_init() error path so the IRQ is

released on probe failure, and route the bdc_init_ep() failure through

err0 instead of returning directly.

This issue was found by an in-house static analysis tool. (NVD)

References