UBUNTU-CVE-2026-98757: Use After Free

In the Linux kernel, the following vulnerability has been resolved: usb: cdns3: fix use-after-free in cdns3gadgetexit() cdns3gadgetstart() arms two works on systemfreezablewq: pendingstatuswq for the deferred ep0 status stage and alignedbufwq for realigned request buffers. Both handlers use the cdns3device the works are embedded in, and cdns3pendingsetupstatushandler() also calls the ep0 request completion. cdns3gadgetexit() does not wait for these works. It frees all endpoints and aligned buffers and drops the last reference to the gadget device, which frees privdev, so a work queued before the exit can run after the free. Fix this by waiting for both works after the gadget driver is unbound and the IRQ is freed, when no new work can be queued, and before the endpoints and buffers are released. This issue was found by an in-house static analysis tool.