CVE-2026-89622: HID: mcp2221: clear rxbuf after I2C/SMBus transfer completes
In the Linux kernel, the following vulnerability has been resolved:
HID: mcp2221: clear rxbuf after I2C/SMBus transfer completes
mcpi2csmbusread() stores the caller-supplied buffer pointer in mcp->rxbuf for the duration of a transfer but never clears it when the transfer finishes or times out. Once the caller frees or reuses the buffer, mcp->rxbuf becomes a dangling pointer. A delayed or spurious MCP2221I2CGETDATA report can then drive mcp2221rawevent() to memcpy device data into the freed memory, causing a write use-after-free.
Route all return paths through a single exit point that clears mcp->rxbuf and mcp->rxbufsize, so that the existing !mcp->rxbuf guard in the rawevent handler can reject any report arriving after the transfer has ended.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.111-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.2.6-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.111-1~deb12u1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.191 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.160 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.111 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.51 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.2.4 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In mcp_i2c_smbus_read(), route all return paths through a single exit point that clears mcp->rxbuf and mcp->rxbuf_size after the I2C/SMBus transfer finishes or times out, allowing the existing !mcp->rxbuf guard in mcp2221_raw_event() to reject late reports.
Event History
Frequently Asked Questions
What conditions are required to trigger the use-after-free?
A caller must complete or time out an I2C/SMBus read through the MCP2221 HID driver, leaving its supplied receive buffer freed or reused. A delayed or spurious MCP2221_I2C_GET_DATA report must then arrive and be processed by the driver's raw-event handler.
What happens if the issue is triggered?
The raw-event handler can copy device data into memory referenced by a stale receive-buffer pointer. This results in a write use-after-free.
How does the resolved code prevent late reports from using the stale buffer?
It clears mcp->rxbuf and mcp->rxbuf_size on all transfer return paths. The existing !mcp->rxbuf check in the raw-event handler then rejects reports received after the transfer has ended.