CVE-2026-80830

A flaw was found in the Linux kernel's USB subsystem. A race condition in the usb_wakeup_notification() function could allow a local attacker or a malicious USB device to trigger a use-after-free vulnerability. This could lead to system instability or a denial of service by causing the system to dereference freed memory.

A race in usb_wakeup_notification() can occur because the function accessed USB hub state without device_state_lock while hub_disconnect() uses that lock to protect teardown. The xHCI driver can call this path from IRQ context, so a wakeup notification may run concurrently with hub disconnect and dereference freed hub or port memory. For the CVSS the PR:N is used for the paranoid score because a malicious or controlled USB device can potentially trigger the hardware event without needing an account on the target system, although physical access to the USB bus is still required. The issue is not network reachable. Impact is at least denial of service via kernel crash, and in the worst still defensible interpretation it may allow confidentiality or integrity impact because this is a race based use after free candidate involving access to freed kernel objects.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.