CVE-2026-98757 (GCVE-0-2026-98757)
Vulnerability from cvelistv5
Published
2026-10-18 15:47
Modified
2026-10-21 12:56
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: usb: cdns3: fix use-after-free in cdns3_gadget_exit() cdns3_gadget_start() arms two works on system_freezable_wq: pending_status_wq for the deferred ep0 status stage and aligned_buf_wq for realigned request buffers. Both handlers use the cdns3_device the works are embedded in, and cdns3_pending_setup_status_handler() also calls the ep0 request completion. cdns3_gadget_exit() does not wait for these works. It frees all endpoints and aligned buffers and drops the last reference to the gadget device, which frees priv_dev, so a work queued before the exit can run after the free. Fix this by waiting for both works after the gadget driver is unbound and the IRQ is freed, when no new work can be queued, and before the endpoints and buffers are released. This issue was found by an in-house static analysis tool.
References
Impacted products
Vendor Product Version
Linux Linux Version: 7733f6c32e36ff9d7adadf40001039bf219b1cbe
Version: 7733f6c32e36ff9d7adadf40001039bf219b1cbe
Version: 7733f6c32e36ff9d7adadf40001039bf219b1cbe
Version: 7733f6c32e36ff9d7adadf40001039bf219b1cbe
Version: 7733f6c32e36ff9d7adadf40001039bf219b1cbe
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/cdns3/cdns3-gadget.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "efdf0ddaed01161dc1c1f25382856f2fd1c1f44f",
              "status": "affected",
              "version": "7733f6c32e36ff9d7adadf40001039bf219b1cbe",
              "versionType": "git"
            },
            {
              "lessThan": "cc448700db656cceb4b411bf99a2e7132144d035",
              "status": "affected",
              "version": "7733f6c32e36ff9d7adadf40001039bf219b1cbe",
              "versionType": "git"
            },
            {
              "lessThan": "95160fe606e685ff18de1e6ddcbc08289476004e",
              "status": "affected",
              "version": "7733f6c32e36ff9d7adadf40001039bf219b1cbe",
              "versionType": "git"
            },
            {
              "lessThan": "159dada48ee2d53eff46e66a8011d67b2c209bbc",
              "status": "affected",
              "version": "7733f6c32e36ff9d7adadf40001039bf219b1cbe",
              "versionType": "git"
            },
            {
              "lessThan": "ebe9b68c396792c15d0ac690d592e449e74ed804",
              "status": "affected",
              "version": "7733f6c32e36ff9d7adadf40001039bf219b1cbe",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/cdns3/cdns3-gadget.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.4"
            },
            {
              "lessThan": "5.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.160",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.113",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.56",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.160",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.113",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.56",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.10",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: cdns3: fix use-after-free in cdns3_gadget_exit()\n\ncdns3_gadget_start() arms two works on system_freezable_wq:\npending_status_wq for the deferred ep0 status stage and aligned_buf_wq\nfor realigned request buffers. Both handlers use the cdns3_device the\nworks are embedded in, and cdns3_pending_setup_status_handler() also\ncalls the ep0 request completion.\n\ncdns3_gadget_exit() does not wait for these works. It frees all\nendpoints and aligned buffers and drops the last reference to the\ngadget device, which frees priv_dev, so a work queued before the exit\ncan run after the free.\n\nFix this by waiting for both works after the gadget driver is unbound\nand the IRQ is freed, when no new work can be queued, and before the\nendpoints and buffers are released.\n\nThis issue was found by an in-house static analysis tool."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-21T12:56:33.270Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/efdf0ddaed01161dc1c1f25382856f2fd1c1f44f"
        },
        {
          "url": "https://git.kernel.org/stable/c/cc448700db656cceb4b411bf99a2e7132144d035"
        },
        {
          "url": "https://git.kernel.org/stable/c/95160fe606e685ff18de1e6ddcbc08289476004e"
        },
        {
          "url": "https://git.kernel.org/stable/c/159dada48ee2d53eff46e66a8011d67b2c209bbc"
        },
        {
          "url": "https://git.kernel.org/stable/c/ebe9b68c396792c15d0ac690d592e449e74ed804"
        }
      ],
      "title": "usb: cdns3: fix use-after-free in cdns3_gadget_exit()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-98757",
    "datePublished": "2026-10-18T15:47:44.486Z",
    "dateReserved": "2026-09-25T10:25:14.368Z",
    "dateUpdated": "2026-10-21T12:56:33.270Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.