EUVD-2026-76534
GHSA-hmph-x79p-jwjq
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
AV:L and PR:L correct; AC:H reflects timing dependency between buffer free and asynchronous delayed USB HID report arrival.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
6DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
HID: mcp2221: clear rxbuf after I2C/SMBus transfer completes
mcp_i2c_smbus_read() stores the caller-supplied buffer pointer in mcp->rxbuf for the duration of a transfer but never clears it when the transfer finishes or times out. Once the caller frees or reuses the buffer, mcp->rxbuf becomes a dangling pointer. A delayed or spurious MCP2221_I2C_GET_DATA report can then drive mcp2221_raw_event() to memcpy device data into the freed memory, causing a write use-after-free.
Route all return paths through a single exit point that clears mcp->rxbuf and mcp->rxbuf_size, so that the existing !mcp->rxbuf guard in the raw_event handler can reject any report arriving after the transfer has ended.
AnalysisAI
Write use-after-free in the Linux kernel HID mcp2221 driver allows a local low-privileged user to corrupt kernel memory via a dangling pointer left in the driver's rxbuf field after an I2C/SMBus read transfer ends. The mcp_i2c_smbus_read() function stores the caller-supplied buffer pointer in mcp->rxbuf for the transfer's lifetime but fails to clear it on any return path; a delayed or spurious MCP2221_I2C_GET_DATA USB HID report arriving after the caller frees or reuses the buffer causes mcp2221_raw_event() to memcpy device-controlled data into freed kernel memory. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all of the following: (1) local unprivileged code execution on the target host; (2) a Microchip MCP2221 USB device physically connected and its hid-mcp2221 kernel module loaded; (3) the ability to initiate I2C/SMBus read transfers through the driver's userspace interface; and (4) a delayed or spurious MCP2221_I2C_GET_DATA USB HID report reaching mcp2221_raw_event() after the I2C transfer has completed and the caller's buffer has been freed or reused - introducing a timing or device-cooperation dependency. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-assigned CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/C:H/I:H/A:H) is a defensible baseline for a kernel UAF write, but AC:L slightly understates the timing dependency inherent in the race between buffer release and a delayed USB HID report arrival; AC:H is arguably more accurate. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Linux kernel 7.2.4 or 6.18.51 on stable branches, or 7.3-rc1 on development. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: inventory production systems with MCP2221 USB devices by reviewing hardware manifests and checking kernel driver logs for mcp2221 presence. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today