CVE-2026-98762: USB: dwc2: shut down wakeup timer before freeing HCD state
In the Linux kernel, the following vulnerability has been resolved:
USB: dwc2: shut down wakeup timer before freeing HCD state
dwc2wakeupdetected() accesses the DWC2 host state and can rearm the wakeup timer. dwc2hcdfree() currently deletes the timer only after freeing host-owned state, and timerdelete() does not synchronize a callback or prevent it from being queued again.
Stop and shut down the timer in dwc2hcdrelease(), before the HCD resources are freed. This covers both the HCD initialization error path and normal HCD removal.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In dwc2_hcd_release(), stop and shut down the DWC2 wakeup timer before releasing or freeing HCD state; synchronize timer callbacks so dwc2_wakeup_detected() cannot access freed host state or rearm the timer.