In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: ftcm: synchronize delayed setalt with teardown

The ftcm setalt() path defers endpoint setup to a work item and completes the delayed status response from process context. The delayed work uses ftcm private state and may complete the setup request after disconnect or function teardown has already moved on.

Cancel and drain the delayed setalt work when the function is unbound or freed. For disable paths, which are reached under the composite device lock, use a small state machine and a non-sleeping cancellation path instead of cancelworksync(). If the work is already running, mark it cancelled and let the worker own the cleanup; otherwise tcmdisable() can cancel the queued work and clean up immediately.

Also serialize the final delayed-status completion with the cancellation check while holding the composite device lock. This prevents a disconnect from clearing delayedstatus while the worker is about to complete the control request.

Validation reproduced this kernel report: BUG: KASAN: slab-use-after-free in tcmdelayedsetalt+0x6c/0xef0

Call Trace: <TASK> dumpstacklvl+0x66/0xa0 printreport+0xce/0x630 ? tcmdelayedsetalt+0x6c/0xef0 ? srsoaliasreturnthunk+0x5/0xfbef5 ? virtaddrvalid+0x188/0x320 ? tcmdelayedsetalt+0x6c/0xef0 kasanreport+0xe0/0x110 ? tcmdelayedsetalt+0x6c/0xef0 tcmdelayedsetalt+0x6c/0xef0 ? pfxtcmdelayedsetalt+0x10/0x10 ? processonework+0x4cb/0xb90 ? rcuiswatching+0x20/0x50 ? tcmdelayedsetalt+0x9/0xef0 processonework+0x4d7/0xb90 ? pfxprocessonework+0x10/0x10 ? srsoaliasreturnthunk+0x5/0xfbef5 ? listaddvalidorreport+0x37/0xf0 ? pfxtcmdelayedsetalt+0x10/0x10 ? srsoaliasreturnthunk+0x5/0xfbef5 workerthread+0x2d8/0x570 ? pfxworkerthread+0x10/0x10 kthread+0x1ad/0x1f0 ? pfxkthread+0x10/0x10 retfromfork+0x3c9/0x540 ? pfxretfromfork+0x10/0x10 ? srsoaliasreturnthunk+0x5/0xfbef5 ? switchto+0x2e9/0x730 ? pfxkthread+0x10/0x10 retfromforkasm+0x1a/0x30 </TASK>

Allocated by task 544: kasansavestack+0x33/0x60 kasansavetrack+0x14/0x30 kasankmalloc+0x8f/0xa0 tcmalloc+0x68/0x180 usbgetfunction+0x36/0x60 configusbcfglink+0x125/0x1b0 configfssymlink+0x322/0x890 vfssymlink+0xc2/0x270 filenamesymlinkat+0x295/0x2f0 x64syssymlinkat+0x62/0x90 dosyscall64+0x115/0x6a0 entrySYSCALL64afterhwframe+0x77/0x7f

Freed by task 661: kasansavestack+0x33/0x60 kasansavetrack+0x14/0x30 kasansavefreeinfo+0x3b/0x60 kasanslabfree+0x43/0x70 kfree+0x2f9/0x530 configusbcfgunlink+0x173/0x1e0 configfsunlink+0x1fa/0x340 vfsunlink+0x15c/0x510 filenameunlinkat+0x2ba/0x450 x64sysunlinkat+0x63/0x90 dosyscall64+0x115/0x6a0 entrySYSCALL64afterhwframe+0x77/0x7f