CVE-2026-98762

What it actually does

Use-after-free in the dwc2 USB host controller driver: dwc2_wakeup_detected() can access or re-arm a timer after dwc2_hcd_free() has released the associated HCD state because timer deletion occurs too late and lacks synchronization against pending callbacks.

Why it matters to the business

Linux systems using dwc2-based USB hardware may experience kernel crashes, memory corruption, or potential local privilege escalation, resulting in service outages or security exposure until kernels are updated.

How an attack unfolds

An attacker with local access triggers HCD removal or initialization failure paths while the wakeup timer remains active; when the timer later fires, its callback dereferences already-freed host state, enabling memory corruption that can be leveraged for code execution.

How to fix it

Update the Linux kernel to a version containing the fix that calls timer shutdown in dwc2_hcd_release() before any host state is freed; rebuild and reboot affected systems.

How to confirm the fix worked

Confirm the presence of the timer shutdown change in dwc2_hcd_release(), verify no timer callbacks can run after state release via code inspection or kernel debugging, and test HCD load/unload paths under load.

Typical attack path

1. Obtain local access on a system using the dwc2 driver
2. Trigger HCD initialization error or device removal to invoke dwc2_hcd_release()
3. Arrange for the wakeup timer to remain pending or re-armed
4. Allow the timer callback to execute against freed memory
5. Exploit resulting UAF for privilege escalation or denial of service

How to detect it

Review kernel logs and crash dumps for dwc2_wakeup_detected references, use-after-free warnings, or panics during USB host controller removal; correlate with device hot-plug or driver unload events.

• dwc2_wakeup_detected
• dwc2_hcd_release
• dwc2_hcd_free
• timer_delete
• USB dwc2 use-after-free

What your security team should do

• Apply the upstream dwc2 timer fix to all production kernels within the next patch cycle
• Monitor kernel update channels for dwc2-related commits and schedule reboots
• Restrict unprivileged local access on systems exposing dwc2 USB controllers until patched
• Include dwc2 UAF patterns in crash-dump and kernel log review procedures