CVE-2026-89622: HID: mcp2221: clear rxbuf after I2C/SMBus transfer completes
In the Linux kernel, the following vulnerability has been resolved:
HID: mcp2221: clear rxbuf after I2C/SMBus transfer completes
mcpi2csmbusread() stores the caller-supplied buffer pointer in mcp->rxbuf for the duration of a transfer but never clears it when the transfer finishes or times out. Once the caller frees or reuses the buffer, mcp->rxbuf becomes a dangling pointer. A delayed or spurious MCP2221I2CGETDATA report can then drive mcp2221rawevent() to memcpy device data into the freed memory, causing a write use-after-free.
Route all return paths through a single exit point that clears mcp->rxbuf and mcp->rxbufsize, so that the existing !mcp->rxbuf guard in the rawevent handler can reject any report arriving after the transfer has ended.
Affected Software
Event History
Frequently Asked Questions
What conditions are required to trigger the use-after-free?
A caller must complete or time out an I2C/SMBus read through the MCP2221 HID driver, leaving its supplied receive buffer freed or reused. A delayed or spurious MCP2221_I2C_GET_DATA report must then arrive and be processed by the driver's raw-event handler.
What happens if the issue is triggered?
The raw-event handler can copy device data into memory referenced by a stale receive-buffer pointer. This results in a write use-after-free.
How does the resolved code prevent late reports from using the stale buffer?
It clears mcp->rxbuf and mcp->rxbuf_size on all transfer return paths. The existing !mcp->rxbuf check in the raw-event handler then rejects reports received after the transfer has ended.