CVE-2026-89738
kernel: usb: gadget: at91_udc: drain polled-VBUS timer/work before udc is freed
Severity
ModerateRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · September 11, 2026
Updated · October 31, 2026
Description
A flaw was found in the Linux kernel's at91_udc USB gadget driver. In polled-VBUS mode, a timing issue during driver unbinding or probe failure can lead to a use-after-free vulnerability. A local attacker could exploit this by triggering a normal driver unbind operation, which may interleave with an already queued work item. This could result in system instability or a denial of service (DoS) due to the driver attempting to access freed memory.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.1 · 5.5CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-825 · Expired Pointer Dereference