CVE-2026-85032: Use-after-free in the MCTP over USB binding when the host disables the class while RX parsing is in progress

The MCTP over USB device class in subsys/pmci/mctp/mctpusb.c splits RX handling across two threads: the system workqueue runs mctpusbclassoutwork(), which parses host OUT data byte by byte and fills a packet buffer at usb->rxpkt, while the USB device stack thread runs mctpusbclassdisable(). The disable handler used kworkcancel(), which removes a queued work item but returns immediately without waiting for a handler that is already running, and then called mctpusbresetrxstate() to mctppktbuffree() the packet buffer the worker may still be using.

Both entry points into mctpusbclassdisable() are driven by the attached USB host: a SETCONFIGURATION request and a USB bus reset both reach it via usbdconfigreset() in subsys/usb/devicenext/usbdconfig.c. A host that streams partial MCTP frames on the bulk OUT endpoint and repeatedly forces a configuration change or bus reset therefore controls both the data being parsed and the moment the teardown runs, and can retry the race indefinitely without credentials or user interaction.

If the free lands while the worker holds the pointer, the worker writes host-supplied bytes into freed memory of the dedicated MCTP heap (CONFIGMCTPHEAPSIZE in subsys/pmci/mctp/mctpmemory.c), corrupting recycled buffers or sysheap free-block metadata; this window requires genuine parallelism, i.e. CONFIGSMP or a preemptible CONFIGSYSTEMWORKQUEUEPRIORITY. With the default cooperative workqueue the worker can still yield inside mctpbusrx() (application callback or a control-message reply blocking in mctpusbtx()), after which it resumes and calls mctppktbuffree(usb->rxpkt) on a pointer the teardown has NULLed, dereferencing NULL and faulting on targets with null-pointer detection.

The fix replaces the cancel with kworkcancelsync() plus a new struct kworksync outworksync, so disable waits for the RX worker to finish before draining the FIFO and freeing the packet buffer. The affected code is the MCTP subsystem, which is marked experimental, built only with CONFIGMCTPUSB.