CVE-2026-93141: usb: gadget: r8a66597: avoid double free of ep0_req in probe error path
In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: r8a66597: avoid double free of ep0req in probe error path
If usbaddgadgetudc() fails, r8a66597probe() jumps to erraddudc and frees ep0req, then falls through to cleanup2 where ep0req is freed again when it is non-NULL.
Remove the redundant free from erraddudc and keep the cleanup in cleanup2 so the request is released exactly once.
Issue found using a prototype static analysis tool and confirmed by code review.
Affected Software
Event History
Frequently Asked Questions
When can the double free occur?
It occurs only when usb_add_gadget_udc() fails during r8a66597_probe(). That error path frees ep0_req and then reaches a later cleanup block that frees the same non-NULL request again.
How was this issue identified?
The issue was found using a prototype static analysis tool and then confirmed by code review.