UBUNTU-CVE-2026-89739: Use After Free
In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: gadget: Fix use-after-free in dwc3gadgetfreeendpoints due to race condition In dwc3gadgetinitendpoint, &dep->nostreamwork is bound with dwc3nostreamwork, and dwc3gadgetendpointstreamevent can queue this delayed work on systempercpuwq when a DEPEVTSTREAMNOSTREAM event is received. If we remove the gadget, dwc3gadgetfreeendpoints makes cleanup and the memory allocated for dep with kzalloc() is released by kfree(dep), while the delayed work mentioned above may still be pending or running. The sequence of operations that may lead to a UAF bug is as follows: CPU0 CPU1 | dwc3threadinterrupt | dwc3endpointinterrupt | dwc3gadgetendpointstreamevent | queuedelayedwork(systempercpuwq, | &dep->nostreamwork) dwc3gadgetfreeendpoints | dwc3freetrbpool(dep) | listdel(&dep->endpoint.eplist) | dwc3debugfsremoveendpointdir(dep) | kfree(dep) | // dep is freed | | dwc3nostreamwork | // use dep (use-after-free) Fix it by canceling the delayed work before kfree(dep) in dwc3gadgetfreeendpoints.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In dwc3_gadget_free_endpoints, cancel the delayed dep->nostream_work before calling kfree(dep), preventing dwc3_nostream_work from using the freed endpoint.
Event History
Frequently Asked Questions
Which systems are exposed to this race condition?
Systems using the affected Ubuntu Linux kernel packages are exposed when the DWC3 USB controller is operating in gadget mode. The listed packages are linux-riscv, linux-realtime, linux-hwe-edge, linux-azure, linux-gcp, linux-azure-fde, linux-gke, and linux-aws-5.0.
What condition is required to trigger the use-after-free?
A DEPEVT_STREAM_NOSTREAM event must queue the endpoint's delayed nostream work while the gadget is being removed. The endpoint memory can then be freed before the queued or running work accesses it.
How was the issue fixed?
The fix cancels the endpoint's delayed nostream work in dwc3_gadget_free_endpoints before freeing the endpoint memory. This prevents dwc3_nostream_work from accessing a freed endpoint structure.