Cloudanix VulnDB

CVE-2026-98757

None

CVSS

—

EPSS

0.2%

Published

Oct 18, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A timing flaw in a USB gadget driver inside the Linux kernel can let already-freed memory be used again, which could make the system crash or allow an attacker who is already on the machine to gain more control.

Chainable
Exploitation
Local Privilege
Attacker needs
Local User
Complexity
High
Impact
Privilege Gain
Component
OS kernel
Class
Use After Free
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Use-after-free in cdns3 USB gadget driver where pending work items on system_freezable_wq (pending_status_wq and aligned_buf_wq) can execute after cdns3_gadget_exit frees the cdns3_device and its embedded structures, because exit does not synchronize with the queued handlers.

Why it matters to the business

Kernel memory corruption or system instability on affected Linux systems using the cdns3 USB gadget controller; low exploitability and no known active campaigns reduce immediate operational risk, but unpatched systems remain exposed to local attacks that could crash the kernel or escalate privileges.

How an attack unfolds

An attacker with local access triggers cdns3_gadget_start to queue the two work items, then forces or races cdns3_gadget_exit (for example via driver unbind or device removal) before the works complete; the freed cdns3_device is then dereferenced inside the work handlers, enabling memory corruption that may be turned into code execution or a denial of service.

How to fix it

Update the Linux kernel to a version containing the fix that waits for both work items after unbinding the gadget driver and freeing the IRQ but before releasing endpoints and buffers; apply the patch or newer mainline/stable release that resolves the synchronization issue in cdns3_gadget_exit.

How to confirm the fix worked

Confirm the kernel source contains the added wait_for_completion or flush_work calls after IRQ disable in cdns3_gadget_exit; rebuild, boot the updated kernel, and exercise gadget attach/detach paths while monitoring for use-after-free reports in dmesg or kmemleak.

Typical attack path

  1. Obtain local access on a system exposing the cdns3 USB gadget
  2. Trigger gadget start to arm pending_status_wq and aligned_buf_wq
  3. Cause or race gadget exit / driver unbind while works are still queued
  4. Work handler dereferences already-freed cdns3_device leading to UAF
  5. Leverage resulting memory corruption for privilege escalation or crash

How to detect it

Inspect kernel logs and dmesg for cdns3 work-handler crashes, use-after-free warnings, or slab corruption immediately after gadget exit or USB device removal events; correlate with process activity that performs driver unbind or hot-unplug of cdns3 devices.

What your security team should do

  • Prioritize patching systems that expose cdns3 USB gadget functionality even though EPSS is low
  • Review and restrict local USB gadget configuration and driver loading where possible
  • Monitor kernel logs for cdns3-related oops or slab-use-after-free warnings
  • Apply the fix within normal patch windows given the five-day publication age and static-analysis origin

The record

In the Linux kernel, the following vulnerability has been resolved: usb: cdns3: fix use-after-free in cdns3_gadget_exit() cdns3_gadget_start() arms two works on system_freezable_wq: pending_status_wq for the deferred ep0 status stage and aligned_buf_wq for realigned request buffers. Both handlers use the cdns3_device the works are embedded in, and cdns3_pending_setup_status_handler() also calls the ep0 request completion. cdns3_gadget_exit() does not wait for these works. It frees all endpoints and aligned buffers and drops the last reference to the gadget device, which frees priv_dev, so a work queued before the exit can run after the free. Fix this by waiting for both works after the gadget driver is unbound and the IRQ is freed, when no new work can be queued, and before the endpoints and buffers are released. This issue was found by an in-house static analysis tool.

Affected packages

Ecosystem Package Introduced Fixed