CVE-2026-98766: usb: gadget: aspeed-vhub: cancel wake work on device removal
In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: aspeed-vhub: cancel wake work on device removal
wakework is armed from the gadget .wakeup callback to resume suspended downstream ports, and it is never cancelled in astvhubremove(), so a work item queued before or during removal can run after devm has freed vhub and its ports, a use-after-free.
Cancelling the work alone is not sufficient: usbgadgetwakeup() takes no lock and the unbind path never clears wakeupen, so a remote-wakeup request in flight on another CPU can re-arm the work after the cancel and before vhub is freed.
astvhubdeldev() already clears d->registered under vhub->lock before unregistering the gadget. Refuse the wakeup in astvhubudcwakeup() once d->registered is clear: the check and the schedulework() are then atomic against the unbind, so a wakeup that passed before the flag was cleared is drained by the cancelworksync() after the deldev loop, and one that arrives later returns without arming. Also move INITWORK() to the top of astvhubprobe(), since the probe error path reuses astvhubremove() and would otherwise cancel a never-initialized work item.
This issue was found by an in-house static analysis tool.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In the Linux kernel aspeed-vhub gadget driver, refuse wakeups once the device is unregistered, clear d->registered under vhub->lock before removal, and use cancel_work_sync() after the ast_vhub_del_dev() loop to drain wake_work; initialize wake_work at the top of ast_vhub_probe() so probe-error cleanup cannot cancel an uninitialized work item.