CVE-2026-80824

A flaw was found in the Linux kernel's USB subsystem (usbfs). An unprivileged local attacker with read/write access to a /dev/bus/usb node could exploit a use-after-free vulnerability. This occurs because the usb_device structure is prematurely freed before all pending operations are completed. Successful exploitation of this memory corruption flaw could lead to a system crash or potentially privilege escalation.

An Important severity use-after-free flaw was found in the Linux kernel usbfs (USB user-space) subsystem, affecting the kernel and kernel-rt packages in Red Hat Enterprise Linux and other Red Hat products that ship the Red Hat kernel. In usbdev_release(), the reference to the struct usb_device is dropped before the list of completed asynchronous URBs is drained, and the drain path (free_async() calling dec_usb_memory_use_count()) then reads back through the already-freed device, for example via bus_to_hcd(ps->dev->bus). An unprivileged local attacker with read/write access to a /dev/bus/usb device node could mmap() the file descriptor, submit an asynchronous URB whose buffer lies inside that mapping, wait for the device to be unplugged so that the usbfs reference becomes the last reference and the device is freed, and then unmap and close the file descriptor, deterministically triggering the use-after-free. Successful exploitation of this memory corruption flaw could lead to a kernel crash (denial of service) or potentially privilege escalation. Red Hat rates this flaw with a CVSS 3.1 score of 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H): although triggering the use-after-free itself is deterministic and not a race, reliably converting it into privilege escalation requires high attack complexity. A fix is being pursued for the affected Red Hat products.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.