CVE-2026-64583

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown<br /> <br /> The Broadcom BDC UDC driver registers its IRQ handler with<br /> devm_request_irq() in bdc_udc_init(), so the IRQ is released by devm<br /> only after bdc_remove() returns. devm releases resources in reverse<br /> LIFO order, but bdc_remove() runs bdc_udc_exit() and bdc_hw_exit() -&gt;<br /> bdc_mem_free() manually before returning: bdc_udc_exit() tears down<br /> individual endpoint objects via bdc_free_ep(), while bdc_hw_exit() -&gt;<br /> bdc_mem_free() frees and NULLs the DMA-coherent status-report ring<br /> (bdc-&gt;srr.sr_bds) and kfree()s bdc-&gt;bdc_ep_array. Both happen while<br /> the IRQ handler (bdc_udc_interrupt, requested with IRQF_SHARED)<br /> remains deliverable in the window up to the post-remove devm<br /> free_irq().<br /> <br /> On receipt of a shared interrupt in that window, bdc_udc_interrupt()<br /> dereferences bdc-&gt;srr.sr_bds[bdc-&gt;srr.dqp_index] (NULL or freed DMA)<br /> and dispatches sr_handler callbacks that index into bdc_ep_array,<br /> causing a NULL-deref or use-after-free.<br /> <br /> The same window affects the delayed_work bdc-&gt;func_wake_notify, which is<br /> armed from the IRQ handler via bdc_sr_uspc() -&gt; handle_link_state_change()<br /> -&gt; schedule_delayed_work() and may self-rearm from its own callback<br /> bdc_func_wake_timer(). No cancel exists anywhere in the driver, so a<br /> queued work item that fires after bdc_remove() returns and the bdc<br /> structure is devm-freed dereferences freed memory.<br /> <br /> Replace devm_request_irq() with request_irq() and add an explicit<br /> free_irq(bdc-&gt;irq, bdc) in bdc_remove(). Clear BDC_GIE before<br /> free_irq() to stop the device from asserting interrupts, then<br /> free_irq() drains any in-flight handler, then cancel_delayed_work_sync()<br /> drains the func_wake_notify delayed work. This ordering ensures the<br /> IRQ handler and delayed work cannot interfere with the subsequent<br /> endpoint and DMA teardown in bdc_udc_exit() and bdc_hw_exit(). Wire the<br /> matching free_irq() into the bdc_udc_init() error path so the IRQ is<br /> released on probe failure, and route the bdc_init_ep() failure through<br /> err0 instead of returning directly.<br /> <br /> This issue was found by an in-house static analysis tool.