CVE-2026-98757: usb: cdns3: fix use-after-free in cdns3_gadget_exit()
In the Linux kernel, the following vulnerability has been resolved:
usb: cdns3: fix use-after-free in cdns3gadgetexit()
cdns3gadgetstart() arms two works on systemfreezablewq: pendingstatuswq for the deferred ep0 status stage and alignedbufwq for realigned request buffers. Both handlers use the cdns3device the works are embedded in, and cdns3pendingsetupstatushandler() also calls the ep0 request completion.
cdns3gadgetexit() does not wait for these works. It frees all endpoints and aligned buffers and drops the last reference to the gadget device, which frees privdev, so a work queued before the exit can run after the free.
Fix this by waiting for both works after the gadget driver is unbound and the IRQ is freed, when no new work can be queued, and before the endpoints and buffers are released.
This issue was found by an in-house static analysis tool.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Wait for both pending_status_wq and aligned_buf_wq works to complete after the gadget driver is unbound, before freeing the device or related resources in cdns3_gadget_exit().