[PATCH] usb: cdc-acm: Fix urb reference leak in acm_resume()

From: Wentao Liang

Date: Thu Sep 17 2026 - 12:32:00 EST


acm_resume() takes the delayed write urbs from the acm->delayed anchor
with usb_get_from_anchor(), which hands the reference held by the
anchor over to the caller. That reference is never released, so an urb
that was queued while the device was suspended is never freed.

Drop the reference after the urb has been resubmitted.

Fixes: 140cb81ac8c6 ("USB: cdc-acm: fix broken runtime suspend")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Wentao Liang <vulab@xxxxxxxxxxx>
---
drivers/usb/class/cdc-acm.c | 1 +
1 file changed, 1 insertion(+)

diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
index 54059e4fc6ed..399c42b58cfc 100644
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -1703,6 +1703,7 @@ static int acm_resume(struct usb_interface *intf)
break;

acm_start_wb(acm, urb->context);
+ usb_free_urb(urb);
}

/*
--
2.34.1