🟡 Medium | Source: Microsoft Security Response Center
CVE-2026-64583 is a Linux kernel vulnerability affecting the USB gadget subsystem, specifically the BDC (Broadcom Device Controller) UDC driver. The flaw involves improper cleanup of IRQs and a wake notification function before device teardown, which can lead to use-after-free or race condition issues. While originating in the Linux kernel, this is relevant to Azure environments running Linux-based virtual machines or containerised workloads.
Security Architect’s Take: Review any Azure Linux VMs or AKS nodes that rely on USB gadget functionality — though rare in cloud contexts, ensure kernel patches are applied promptly via your distribution’s update mechanism. Monitor Microsoft’s MSRC advisory for patch availability and prioritise updates to affected kernel versions in your patching cycle.
Original advisory: CVE-2026-64583 usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown