CVE-2026-89622

The Linux kernel's hid-mcp2221 driver, which supports Microchip MCP2221 USB-to-I2C/UART/GPIO bridge chips, leaves a dangling buffer pointer (mcp->rxbuf) behind after an I2C/SMBus read completes or times out. If the caller frees or reuses that buffer, a delayed or spurious MCP2221_I2C_GET_DATA USB HID report drives mcp2221_raw_event() to memcpy device data into the freed memory, producing a write use-after-free in kernel space. Exploitation requires local access or an attacker-controlled/spoofed USB device (CVSS 3.1: 7.8, local vector, low privileges), and successful corruption of kernel memory could affect confidentiality, integrity, and availability up to privilege escalation or a crash. Only systems running kernels built with the MCP2221 driver (CONFIG_HID_MCP2221) and using the hardware are exposed. No public proof of concept or in-the-wild exploitation is known, and the flaw is not in the CISA KEV catalog.

What to do: Apply your distribution's kernel update once it includes the fix that clears mcp->rxbuf and mcp->rxbuf_size on every return path. Check exposure with 'lsmod | grep mcp2221' or by inspecting your kernel config for CONFIG_HID_MCP2221; systems without the driver or device are not affected. On systems where the adapter is used, restrict untrusted local accounts and unattended physical USB access, since a malicious USB device or local user is the realistic trigger.