CVE-2026-16147: it82xx2 USB device controller submits incomplete OUT transfer buffers, causing use-after-free and event-list corruption
The ITE IT82xx2 USB device-controller driver (drivers/usb/udc/udcit82xx2.c) mishandles multi-packet OUT transfers on non-control endpoints. In workhandlerout() the active transfer buffer is obtained with udcbufpeek() (which does not dequeue it); when a full max-packet-size packet arrives but the buffer still has tailroom (the transfer is not yet complete), the pre-fix code both re-arms the endpoint to keep filling that same buf via workhandlerxfercontinue() and simultaneously hands the same, still-being-filled buffer to the upper stack with udcsubmitepevent().
Because udcsubmitepevent() transfers ownership of the buffer to the USB device stack (usbdeventcarrier() appends &buf->node to udsctx->epevents, after which the class handler processes and netbufunref()s it), the driver continues to DMA subsequent host-controlled OUT packets into a buffer the upper stack may already have freed and recycled — a use-after-free write. In addition, since the buffer was never dequeued, the completing packet runs udcbufget() on the same object and submits it a second time, appending &buf->node to the event slist twice (singly-linked-list corruption) and causing a double netbufunref().
The IT82xx2 is a USB peripheral controller, so the untrusted USB host controls OUT-transfer packetization and can force this path against any non-control OUT endpoint whose queued buffer exceeds one packet — an ordinary bulk/interrupt pattern. The driver and USB device stack run in kernel context above the external host, giving the host a device-side kernel heap-corruption primitive: a reliable denial of service and, because the written bytes are attacker-controlled, plausible corruption of adjacent netbuf pool memory. The vector is physical (USB attach). The fix defers submission until the buffer is completely filled and lets xferworkhandler() drive continuation, so each OUT buffer is submitted to the upper stack exactly once.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the ITE IT82xx2 USB device-controller driver are exposed when they handle multi-packet OUT transfers on non-control USB endpoints. The affected condition occurs when a full maximum-packet-size OUT packet is received while the active transfer buffer still has remaining tailroom.
What access does an attacker need to trigger the flaw?
An attacker needs the ability to act as, or connect, a USB host and send host-controlled OUT packets to the device. The supplied vector indicates physical access, with no privileges or user interaction required.
What can happen after successful triggering?
Subsequent OUT data may be DMA-written into a buffer that the upper USB stack has already freed and potentially recycled. The same buffer can also be submitted twice, corrupting the endpoint event singly linked list.