CVE-2026-89622

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> HID: mcp2221: clear rxbuf after I2C/SMBus transfer completes<br /> <br /> mcp_i2c_smbus_read() stores the caller-supplied buffer pointer in<br /> mcp-&gt;rxbuf for the duration of a transfer but never clears it when the<br /> transfer finishes or times out. Once the caller frees or reuses the<br /> buffer, mcp-&gt;rxbuf becomes a dangling pointer. A delayed or spurious<br /> MCP2221_I2C_GET_DATA report can then drive mcp2221_raw_event() to<br /> memcpy device data into the freed memory, causing a write<br /> use-after-free.<br /> <br /> Route all return paths through a single exit point that clears<br /> mcp-&gt;rxbuf and mcp-&gt;rxbuf_size, so that the existing !mcp-&gt;rxbuf guard<br /> in the raw_event handler can reject any report arriving after the<br /> transfer has ended.