Answer in brief
CVE-2026-89622 records a High severity (CVSS 7.8) vulnerability in HID: mcp2221: clear rxbuf after I2C/SMBus transfer completes. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic), Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.8. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic), Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=67a95c21463d066060b0f66d65a75d45bb386ffb <03c34309eb1bce1b3b5f7c4a94b703f419120383 || >=67a95c21463d066060b0f66d65a75d45bb386ffb <968546b676d992dd1da3e057d40598231f725996 || >=67a95c21463d066060b0f66d65a75d45bb386ffb <db2333f88729c8aae062cb171ed058725ff5c901 | 03c34309eb1bce1b3b5f7c4a94b703f419120383, 968546b676d992dd1da3e057d40598231f725996, db2333f88729c8aae062cb171ed058725ff5c901 |
| Linux/Linuxgeneric | 5.7 | Not reported |
| Linux/Linuxgeneric | >=67a95c21463d066060b0f66d65a75d45bb386ffb <d6c6b293173c0ea87189501cbd77e8fa677814a1 || >=67a95c21463d066060b0f66d65a75d45bb386ffb <03c34309eb1bce1b3b5f7c4a94b703f419120383 || >=67a95c21463d066060b0f66d65a75d45bb386ffb <968546b676d992dd1da3e057d40598231f725996 || >=67a95c21463d066060b0f66d65a75d45bb386ffb <db2333f88729c8aae062cb171ed058725ff5c901 | d6c6b293173c0ea87189501cbd77e8fa677814a1, 03c34309eb1bce1b3b5f7c4a94b703f419120383, 968546b676d992dd1da3e057d40598231f725996, db2333f88729c8aae062cb171ed058725ff5c901 |
| Linux/Linuxgeneric | >=67a95c21463d066060b0f66d65a75d45bb386ffb <bd146a8ff107c6d77e75597decbcd1df0d7900d6 || >=67a95c21463d066060b0f66d65a75d45bb386ffb <d6c6b293173c0ea87189501cbd77e8fa677814a1 || >=67a95c21463d066060b0f66d65a75d45bb386ffb <03c34309eb1bce1b3b5f7c4a94b703f419120383 || >=67a95c21463d066060b0f66d65a75d45bb386ffb <968546b676d992dd1da3e057d40598231f725996 || >=67a95c21463d066060b0f66d65a75d45bb386ffb <db2333f88729c8aae062cb171ed058725ff5c901 | bd146a8ff107c6d77e75597decbcd1df0d7900d6, d6c6b293173c0ea87189501cbd77e8fa677814a1, 03c34309eb1bce1b3b5f7c4a94b703f419120383, 968546b676d992dd1da3e057d40598231f725996, db2333f88729c8aae062cb171ed058725ff5c901 |
Published upstream
Sep 11, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 21, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Sep 11, 2026
In the Linux kernel, the following vulnerability has been resolved: HID: mcp2221: clear rxbuf after I2C/SMBus transfer completes mcp_i2c_smbus_read() stores the caller-supplied buffer pointer in mcp->rxbuf for the duration of a transfer but never clears it when the transfer finishes or times out. Once the caller frees or reuses the buffer, mcp->rxbuf becomes a dangling pointer. A delayed or spurious MCP2221_I2C_GET_DATA report can then drive mcp2221_raw_event() to memcpy device data into the freed memory, causing a write use-after-free. Route all return paths through a single exit point that clears mcp->rxbuf and mcp->rxbuf_size, so that the existing !mcp->rxbuf guard in the raw_event handler can reject any report arriving after the transfer has ended.
Quoted source text, attributed separately from HOL analysis.