Cloudanix VulnDB

CVE-2026-89739

None

CVSS

—

EPSS

0.2%

Published

Sep 11, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A timing flaw in the Linux USB gadget driver can let the system try to use memory it has already thrown away, which may crash the machine or let an attacker gain extra privileges.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Full Compromise
Component
OS kernel
Class
Use After Free
Remediation
Patch
Effort
Low
Patch risk
Low

What it actually does

Race condition allows a pending delayed work item (dwc3_nostream_work) to access a kzalloc'd endpoint structure after dwc3_gadget_free_endpoints has already called kfree on it, producing a classic use-after-free in the USB gadget path.

Why it matters to the business

Linux-based devices that expose USB gadget functionality can experience kernel memory corruption, leading to crashes, instability, or potential local privilege escalation when the gadget is unbound while stream events are still in flight.

How an attack unfolds

An attacker with the ability to trigger gadget removal (e.g., via userspace USB gadget API or physical unplug) races against an incoming DEPEVT_STREAM_NOSTREAM event; the work item is queued on system_percpu_wq after the structure is freed, allowing the callback to dereference the dangling pointer.

How to fix it

Apply the upstream fix that cancels the nostream delayed work before freeing the endpoint structure in dwc3_gadget_free_endpoints; rebuild and deploy the patched kernel on all affected systems.

How to confirm the fix worked

Confirm the presence of the cancel_delayed_work_sync call before kfree in dwc3_gadget_free_endpoints; run kernel selftests or USB gadget stress workloads that exercise endpoint creation/teardown under interrupt load.

Typical attack path

  1. Trigger DEPEVT_STREAM_NOSTREAM event to queue dwc3_nostream_work
  2. Initiate gadget teardown (dwc3_gadget_free_endpoints)
  3. Free endpoint memory with kfree while work is still pending or executing
  4. Delayed work callback runs and dereferences freed memory

How to detect it

Inspect kernel logs for use-after-free warnings or oops traces referencing dwc3_gadget_free_endpoints or dwc3_nostream_work; correlate gadget removal events with subsequent delayed-work callbacks in ftrace or perf logs.

What your security team should do

  • Prioritize kernel updates containing the dwc3 gadget UAF fix on all systems that expose USB gadget mode
  • Restrict unprivileged access to USB gadget configuration interfaces until patches are applied
  • Monitor for kernel oops or panic logs containing dwc3_nostream_work or dwc3_gadget_free_endpoints symbols

The record

In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: gadget: Fix use-after-free in dwc3_gadget_free_endpoints due to race condition In dwc3_gadget_init_endpoint, &dep->nostream_work is bound with dwc3_nostream_work, and dwc3_gadget_endpoint_stream_event can queue this delayed work on system_percpu_wq when a DEPEVT_STREAM_NOSTREAM event is received. If we remove the gadget, dwc3_gadget_free_endpoints makes cleanup and the memory allocated for dep with kzalloc() is released by kfree(dep), while the delayed work mentioned above may still be pending or running. The sequence of operations that may lead to a UAF bug is as follows: CPU0 CPU1 | dwc3_thread_interrupt | dwc3_endpoint_interrupt | dwc3_gadget_endpoint_stream_event | queue_delayed_work(system_percpu_wq, | &dep->nostream_work) dwc3_gadget_free_endpoints | dwc3_free_trb_pool(dep) | list_del(&dep->endpoint.ep_list) | dwc3_debugfs_remove_endpoint_dir(dep) | kfree(dep) | // dep is freed | | dwc3_nostream_work | // use dep (use-after-free) Fix it by canceling the delayed work before kfree(dep) in dwc3_gadget_free_endpoints.

Affected packages

Ecosystem Package Introduced Fixed