In the Linux kernel, the following vulnerability has been resolved: USB: c67x00: fix use-after...

In the Linux kernel, the following vulnerability has been resolved:

USB: c67x00: fix use-after-free in c67x00_add_iso_urb()

When TD creation fails for the last packet of an isochronous URB, c67x00_add_iso_urb() gives the URB back before updating the endpoint scheduling state.

c67x00_giveback_urb() frees the URB private data, and the completion callback may release the final URB reference. The following accesses to urbp->ep_data, urb->interval, and urbp->cnt can therefore use freed memory.

Update next_frame and cnt before giving back the failed final packet, making the giveback the last operation that uses the URB and its private data.