CVE-2021-46986

What it actually does

Use-after-free caused by freeing the gadget structure while endpoint list pointers still reference it, resulting in dangling prev/next pointers that trigger invalid list_del operations during subsequent endpoint cleanup or device shutdown.

Why it matters to the business

Systems using affected Linux kernel USB gadget drivers may experience crashes or kernel panics during driver unbind or shutdown, leading to unexpected downtime or loss of USB functionality on affected hardware.

How an attack unfolds

An attacker with local access triggers device removal or shutdown sequences that invoke dwc3_gadget_exit and dwc3_gadget_release in the wrong order, causing the use-after-free when list operations access freed memory; KASAN or shutdown paths can surface the bug as a panic.

How to fix it

Update to a Linux kernel containing the fix that splits usb_del_gadget_udc into separate del and put steps so dwc3_gadget_free_endpoints runs before usb_put_gadget; apply the patch from commit 568262bf5492 or later equivalent stable releases.

How to confirm the fix worked

Confirm the kernel source contains the corrected ordering of usb_del_gadget_udc and usb_put_gadget calls, rebuild, and test driver unbind and shutdown paths under KASAN to verify absence of use-after-free reports.

Typical attack path

1. Obtain local access or trigger USB gadget driver unload
2. Initiate device removal or system shutdown to call dwc3_gadget_exit
3. Trigger dangling pointer dereference in endpoint list cleanup
4. Achieve kernel panic, crash, or potential memory corruption for further exploitation

How to detect it

Review kernel logs for KASAN reports mentioning use-after-free in dwc3_gadget_release or list_del during gadget exit; inspect dmesg and syslog for panic traces referencing dwc3_ep or gadget ep_list on unbind or shutdown.

What your security team should do

• Prioritize kernel updates on systems exposing DWC3 USB gadget functionality
• Monitor vendor advisories for backported fixes in distribution kernels
• Restrict unprivileged access to USB gadget interfaces where feasible
• Enable KASAN or similar debugging on test systems to validate remediation