CVE-2026-80826

In the Linux kernel, the following vulnerability has been resolved:

USB: c67x00: fix use-after-free in c67x00_add_iso_urb()

When TD creation fails for the last packet of an isochronous URB,

c67x00_add_iso_urb() gives the URB back before updating the endpoint

scheduling state.

c67x00_giveback_urb() frees the URB private data, and the completion

callback may release the final URB reference. The following accesses to

urbp->ep_data, urb->interval, and urbp->cnt can therefore use freed

memory.

Update next_frame and cnt before giving back the failed final packet,

making the giveback the last operation that uses the URB and its private

data.