CVE-2026-64583

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The Broadcom BDC UDC driver contains a race condition during the removal process. The driver uses devm request irq() in the bdc udc init() function, which means the interrupt request (IRQ) is only released after the bdc remove() function returns. However, bdc remove() manually triggers bdc udc exit() and bdc hw exit(), which free the DMA-coherent status-report ring bdc->srr.sr bds and the bdc->bdc ep array while the IRQ handler bdc udc interrupt() is still active. If a shared interrupt occurs during this window, the bdc udc interrupt() function may dereference NULL or freed memory, leading to a NULL-dereference or use-after-free. Additionally, the delayed work bdc->func wake notify is not cancelled, allowing it to dereference freed memory if it executes after the bdc structure is released.

Recommendations Replace devm request irq() with request irq() and implement an explicit free irq(bdc->irq, bdc) within bdc remove(). Clear BDC GIE before calling free irq() to stop device interrupts, and use cancel delayed work sync() to drain the func wake notify delayed work before proceeding with the teardown in bdc udc exit() and bdc hw exit().