CVE-2026-98766
Received Received - Intake

USB Gadget Wakeup Use-After-Free in Aspeed vHub

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: aspeed-vhub: cancel wake work on device removal wake_work is armed from the gadget .wakeup callback to resume suspended downstream ports, and it is never cancelled in ast_vhub_remove(), so a work item queued before or during removal can run after devm has freed vhub and its ports, a use-after-free. Cancelling the work alone is not sufficient: usb_gadget_wakeup() takes no lock and the unbind path never clears wakeup_en, so a remote-wakeup request in flight on another CPU can re-arm the work after the cancel and before vhub is freed. ast_vhub_del_dev() already clears d->registered under vhub->lock before unregistering the gadget. Refuse the wakeup in ast_vhub_udc_wakeup() once d->registered is clear: the check and the schedule_work() are then atomic against the unbind, so a wakeup that passed before the flag was cleared is drained by the cancel_work_sync() after the del_dev loop, and one that arrives later returns without arming. Also move INIT_WORK() to the top of ast_vhub_probe(), since the probe error path reuses ast_vhub_remove() and would otherwise cancel a never-initialized work item. This issue was found by an in-house static analysis tool.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-18
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-98766
EUVD
EUVD-2026-103851

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
Linux Linux 7ecca2a4080cb6b1fa174adc588fce9e9014c43c
Linux Linux 7ecca2a4080cb6b1fa174adc588fce9e9014c43c
Linux Linux 7ecca2a4080cb6b1fa174adc588fce9e9014c43c
Linux Linux 7ecca2a4080cb6b1fa174adc588fce9e9014c43c
Linux Linux 4.18

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in the Linux kernel's USB gadget subsystem, specifically in the aspeed-vhub driver. It involves a use-after-free issue where a work item (wake_work) is not properly cancelled during device removal, leading to potential memory corruption if the work item runs after the device memory has been freed.

Detection Guidance

This vulnerability is specific to the Linux kernel's USB gadget subsystem, particularly the aspeed-vhub driver. Detection requires checking if the affected driver is loaded and examining kernel logs for related errors or warnings. Commands like 'lsmod | grep aspeed_vhub' can verify if the module is loaded. Kernel logs can be checked with 'dmesg | grep -i aspeed' or 'journalctl -k | grep -i aspeed' for recent errors.

Impact Analysis

This vulnerability could allow an attacker to trigger a use-after-free condition, potentially causing system crashes, memory corruption, or privilege escalation. It specifically affects systems using the aspeed-vhub USB gadget driver.

Mitigation Strategies

Immediate mitigation involves updating the Linux kernel to a patched version that includes the fix for this vulnerability. Check your distribution's security advisories or kernel updates. If updating is not immediately possible, consider disabling the aspeed-vhub driver if it is not required, using 'modprobe -r aspeed_vhub' (ensure no active devices depend on it).

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98766. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart