CVE-2026-98757: usb: cdns3: fix use-after-free in cdns3_gadget_exit()
In the Linux kernel, the following vulnerability has been resolved:
usb: cdns3: fix use-after-free in cdns3gadgetexit()
cdns3gadgetstart() arms two works on systemfreezablewq: pendingstatuswq for the deferred ep0 status stage and alignedbufwq for realigned request buffers. Both handlers use the cdns3device the works are embedded in, and cdns3pendingsetupstatushandler() also calls the ep0 request completion.
cdns3gadgetexit() does not wait for these works. It frees all endpoints and aligned buffers and drops the last reference to the gadget device, which frees privdev, so a work queued before the exit can run after the free.
Fix this by waiting for both works after the gadget driver is unbound and the IRQ is freed, when no new work can be queued, and before the endpoints and buffers are released.
This issue was found by an in-house static analysis tool.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.113-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.2.10-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 5.10.273 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 5.15.224 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.191 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.160 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.113 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.56 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.2.10 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Compensating control
In cdns3_gadget_exit(), after the gadget driver is unbound and the IRQ is freed so no new work can be queued, wait for both system_freezable_wq works—pending_status_wq and aligned_buf_wq—to complete before releasing endpoints and aligned buffers.
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux kernel's Cadence USB3 (cdns3) gadget driver are exposed when the gadget is being shut down or its driver is unbound. The vulnerable path involves deferred work associated with ep0 status handling and realigned request buffers.
What condition is required for the use-after-free to occur?
Deferred work must have been queued before gadget exit begins, then execute after cdns3_gadget_exit() frees endpoints, aligned buffers, and the cdns3_device structure. The affected work handlers use the freed device state, and one can also invoke ep0 request completion.
What does the fix change?
The fix waits for both pending_status_wq and aligned_buf_wq after the gadget driver is unbound and the IRQ is freed, when no new work can be queued. It performs that wait before endpoints and buffers are released.