CVE-2026-98757 in Linux
Summary
by MITRE • 10/18/2026
In the Linux kernel, the following vulnerability has been resolved:
usb: cdns3: fix use-after-free in cdns3_gadget_exit()
cdns3_gadget_start() arms two works on system_freezable_wq: pending_status_wq for the deferred ep0 status stage and aligned_buf_wq for realigned request buffers. Both handlers use the cdns3_device the works are embedded in, and cdns3_pending_setup_status_handler() also calls the ep0 request completion.
cdns3_gadget_exit() does not wait for these works. It frees all endpoints and aligned buffers and drops the last reference to the gadget device, which frees priv_dev, so a work queued before the exit can run after the free.
Fix this by waiting for both works after the gadget driver is unbound and the IRQ is freed, when no new work can be queued, and before the endpoints and buffers are released.
This issue was found by an in-house static analysis tool.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/19/2026
The Linux kernel vulnerability identified as a use-after-free condition within the Cadence USB3 gadget driver presents a critical risk to system stability and data integrity during device unbinding operations. This flaw resides specifically in the cdns3_gadget_exit function, which is responsible for cleaning up resources when the USB gadget driver is detached from its underlying hardware or virtual interface. The root cause of this vulnerability stems from an improper synchronization mechanism between the asynchronous work queue handlers and the synchronous cleanup routine. When a device is initialized via cdns3_gadget_start, two distinct work items are armed on the system_freezable_wq: pending_status_wq for handling deferred endpoint zero status stages and aligned_buf_wq for managing realigned request buffers. These worker functions operate asynchronously and rely heavily on the persistence of the cdns3_device structure, which contains embedded data structures used by both handlers.
The critical technical flaw occurs because cdns3_gadget_exit fails to ensure that these pending asynchronous tasks have completed their execution before proceeding with resource deallocation. Specifically, when the exit routine is invoked, it immediately frees all endpoints and aligned buffers while dropping the final reference count on the gadget device structure. This action triggers the immediate memory release of the priv_dev private data structure. However, if a work item was queued prior to the initiation of the exit sequence but had not yet begun execution due to scheduling latency or system load, it will continue to run after the underlying memory has been freed. Consequently, when cdns3_pending_setup_status_handler attempts to access members of the now-freed device structure or calls ep0 request completion routines, it accesses invalid memory addresses, leading to a classic use-after-free scenario that can result in kernel panics, arbitrary code execution if an attacker controls the overwritten data, or silent data corruption.
From a security taxonomy perspective, this vulnerability is classified under CWE-416: Use After Free, which describes situations where software uses a pointer after it has been freed, leading to unpredictable behavior and potential exploitation. In terms of adversarial tactics, this flaw aligns with ATT&CK technique T1203: Exploitation for Defense Evasion or potentially T1059: Command and Scripting Interpreter if the resulting crash is leveraged in a denial-of-service attack against critical infrastructure systems relying on USB gadget functionality. The vulnerability highlights a common pitfall in kernel driver development where asynchronous task lifecycle management is not strictly synchronized with resource deallocation phases, particularly during error handling or device removal paths that may be triggered by physical insertion/removal events or virtual machine state changes.
The operational impact of this flaw extends beyond simple system crashes. In environments where USB gadget functionality is exposed to untrusted users or network-adjacent devices, an attacker could potentially trigger the race condition repeatedly to destabilize the host kernel. Furthermore, because the work handlers interact with endpoint zero status stages and buffer realignment logic, successful exploitation might allow for information disclosure of sensitive kernel memory contents that were previously allocated in the freed region if those regions are reused by other subsystems before being fully sanitized. This is particularly dangerous in multi-tenant virtualized environments where USB passthrough or emulation features are utilized, as it could compromise host isolation guarantees.
To mitigate this vulnerability, the implemented fix enforces strict synchronization by waiting for both pending_status_wq and aligned_buf_wq to complete their execution after the gadget driver has been unbound and interrupts have been freed but before any endpoints or buffers are released. This ensures that no new work can be queued during the critical window of resource deallocation and guarantees that all previously queued tasks have finished accessing the device structure. System administrators should apply kernel updates containing this patch immediately to restore safe operation of Cadence USB3 controllers. Developers integrating similar asynchronous patterns in other drivers must review their exit routines to ensure they utilize wait queues or completion variables to block until all pending work items have terminated, thereby preventing access to freed memory regions and maintaining the integrity of the kernel's object lifecycle management.