CVE-2026-98757

Received Received - Intake

Use-After-Free in Linux Kernel CDNS3 Gadget Driver

Publication date: 2026-10-18

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: usb: cdns3: fix use-after-free in cdns3_gadget_exit() cdns3_gadget_start() arms two works on system_freezable_wq: pending_status_wq for the deferred ep0 status stage and aligned_buf_wq for realigned request buffers. Both handlers use the cdns3_device the works are embedded in, and cdns3_pending_setup_status_handler() also calls the ep0 request completion. cdns3_gadget_exit() does not wait for these works. It frees all endpoints and aligned buffers and drops the last reference to the gadget device, which frees priv_dev, so a work queued before the exit can run after the free. Fix this by waiting for both works after the gadget driver is unbound and the IRQ is freed, when no new work can be queued, and before the endpoints and buffers are released. This issue was found by an in-house static analysis tool.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-18

Last Modified

2026-10-19

Generated

2026-10-19

AI Q&A

2026-10-18

EPSS Evaluated

N/A

NVD

CVE-2026-98757

EUVD

EUVD-2026-103842

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	7733f6c32e36ff9d7adadf40001039bf219b1cbe
Linux	Linux	7733f6c32e36ff9d7adadf40001039bf219b1cbe
Linux	Linux	7733f6c32e36ff9d7adadf40001039bf219b1cbe
Linux	Linux	7733f6c32e36ff9d7adadf40001039bf219b1cbe
Linux	Linux	5.4

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a use-after-free vulnerability in the Linux kernel's CDNS3 USB gadget driver. The issue occurs when the cdns3_gadget_exit() function frees resources without waiting for pending work items (pending_status_wq and aligned_buf_wq) to complete. These work items may still access freed memory, leading to potential crashes or arbitrary code execution.

Detection Guidance

This vulnerability is specific to the Linux kernel's cdns3 USB gadget driver and may not have direct network detection methods. Check kernel logs for use-after-free errors related to cdns3 or USB gadget operations. Commands like dmesg | grep cdns3 or journalctl -k | grep cdns3 may help identify issues.

Impact Analysis

If exploited, this vulnerability could cause system instability, crashes, or unauthorized code execution on affected Linux systems using the CDNS3 USB gadget driver. It may lead to denial-of-service conditions or privilege escalation in scenarios where untrusted users can trigger the vulnerable code path.

Compliance Impact

This vulnerability is a use-after-free issue in the Linux kernel's USB gadget subsystem. It does not directly relate to data privacy or security controls required by standards like GDPR or HIPAA. The impact is limited to potential system instability or crashes due to improper memory handling in USB device handling code.

Mitigation Strategies

Apply the latest kernel update that includes the fix for CVE-2026-98757. If immediate patching is not possible, consider disabling the cdns3 USB gadget driver module (cdns3) if it is not required for your system.

Hi! I’m here to help you understand CVE-2026-98757. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70