GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-89738 (GCVE-0-2026-89738)

Vulnerability from cvelistv5 – Published: 2026-09-11 19:46 – Updated: 2026-09-13 06:33
VLAI
Title
usb: gadget: at91_udc: drain polled-VBUS timer/work before udc is freed
Summary
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: at91_udc: drain polled-VBUS timer/work before udc is freed In polled-VBUS mode (board.vbus_pin && board.vbus_polled), probe arms a self-restarting cycle: at91_vbus_timer() schedules vbus_timer_work, and at91_vbus_timer_work() calls at91_vbus_update() and re-arms the timer via mod_timer(). Both recover the same udc through container_of and dereference it on every iteration. Neither teardown path cancels this cycle. udc is devm-allocated, so it is freed after at91udc_remove() returns, and is likewise freed when probe fails and devres runs. A timer callback or work item that is pending or running at either point dereferences the freed udc. Add at91_udc_shutdown_vbus_timer() and call it from at91udc_remove() and from the usb_add_gadget_udc() failure path in probe; the remaining probe error paths fail before the timer is armed. timer_shutdown_sync() waits for a running callback and clears timer->function, which makes the work handler's mod_timer() a permanent no-op; cancel_work_sync() then drains any pending or running work whose re-arm attempt now does nothing. The timer must be shut down first, since cancelling the work alone would let the timer re-queue it. The guard mirrors probe: in IRQ mode the timer and work_struct are never initialized. This does not require a fault; a normal driver unbind can interleave with an already queued work item. This issue was found by an in-house static analysis tool.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 4037242c4f5ff77afe61bf07ca1e8a99490219e5 , < a2a602cb1e28d76a5398cec3fa21b0110385f501 (git)
Affected: 4037242c4f5ff77afe61bf07ca1e8a99490219e5 , < 51a311eb97e91ce1aed3005cb71ccb2e30f8cce8 (git)
Affected: 4037242c4f5ff77afe61bf07ca1e8a99490219e5 , < 557ef547d49ff5e6026a4d39bdd3113bd81d7688 (git)
Affected: 4037242c4f5ff77afe61bf07ca1e8a99490219e5 , < c27d13ce4bab80fbdf6523928071b6c24b37606c (git)
guessed Create a notification for this product.
Linux Linux Affected: 2.6.36
Unaffected: 0 , < 2.6.36 (semver)
Unaffected: 6.12.109 , ≤ 6.12.* (semver)
Unaffected: 6.18.50 , ≤ 6.18.* (semver)
Unaffected: 7.2.4 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/gadget/udc/at91_udc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a2a602cb1e28d76a5398cec3fa21b0110385f501",
              "status": "affected",
              "version": "4037242c4f5ff77afe61bf07ca1e8a99490219e5",
              "versionType": "git"
            },
            {
              "lessThan": "51a311eb97e91ce1aed3005cb71ccb2e30f8cce8",
              "status": "affected",
              "version": "4037242c4f5ff77afe61bf07ca1e8a99490219e5",
              "versionType": "git"
            },
            {
              "lessThan": "557ef547d49ff5e6026a4d39bdd3113bd81d7688",
              "status": "affected",
              "version": "4037242c4f5ff77afe61bf07ca1e8a99490219e5",
              "versionType": "git"
            },
            {
              "lessThan": "c27d13ce4bab80fbdf6523928071b6c24b37606c",
              "status": "affected",
              "version": "4037242c4f5ff77afe61bf07ca1e8a99490219e5",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/gadget/udc/at91_udc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.36"
            },
            {
              "lessThan": "2.6.36",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.109",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.109",
                  "versionStartIncluding": "2.6.36",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.50",
                  "versionStartIncluding": "2.6.36",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "2.6.36",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "2.6.36",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: at91_udc: drain polled-VBUS timer/work before udc is freed\n\nIn polled-VBUS mode (board.vbus_pin \u0026\u0026 board.vbus_polled), probe arms a\nself-restarting cycle: at91_vbus_timer() schedules vbus_timer_work, and\nat91_vbus_timer_work() calls at91_vbus_update() and re-arms the timer via\nmod_timer(). Both recover the same udc through container_of and dereference\nit on every iteration.\n\nNeither teardown path cancels this cycle. udc is devm-allocated, so it is\nfreed after at91udc_remove() returns, and is likewise freed when probe\nfails and devres runs. A timer callback or work item that is pending or\nrunning at either point dereferences the freed udc.\n\nAdd at91_udc_shutdown_vbus_timer() and call it from at91udc_remove() and\nfrom the usb_add_gadget_udc() failure path in probe; the remaining probe\nerror paths fail before the timer is armed. timer_shutdown_sync() waits\nfor a running callback and clears timer-\u003efunction, which makes the work\nhandler\u0027s mod_timer() a permanent no-op; cancel_work_sync() then drains\nany pending or running work whose re-arm attempt now does nothing. The\ntimer must be shut down first, since cancelling the work alone would let\nthe timer re-queue it. The guard mirrors probe: in IRQ mode the timer and\nwork_struct are never initialized.\n\nThis does not require a fault; a normal driver unbind can interleave with\nan already queued work item.\n\nThis issue was found by an in-house static analysis tool."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The use-after-free is reached on local AT91 UDC platform-driver teardown (sysfs unbind, rmmod, or probe-error unwind after the polled-VBUS timer is armed), not by parsing USB host packets. That matches other USB gadget/UDC teardown UAFs scored Local and is higher severity than Physical.\nAC:L - Once polled-VBUS mode is active, unbind or the usb_add_gadget_udc() failure path frees the devm-allocated udc while the self-restarting timer/work still hold it; the next timer tick or already-queued work then dereferences the freed object with no race the attacker cannot drive.\nPR:L - Highest reasonable exposure is a local account that manages the USB gadget/UDC on AT91 industrial, IoT, and embedded controllers, where platform unbind or gadget HAL access is often delegated beyond init-namespace root. Uncertain Low vs High, so Low per the overestimate rule.\nUI:N - The attacker initiates driver unbind, module unload, or a failing re-probe themselves; no separate victim action such as plugging a USB cable, mounting a filesystem, or opening a device node is required.\nS:U - The use-after-free corrupts the host kernel\u0027s struct at91_udc heap object within the same OS security authority and does not cross a VM, IOMMU, or sandbox boundary.\nC:H - at91_vbus_timer() and at91_vbus_timer_work() recover the freed udc via container_of and read vbus_pin, gadget state, and related fields; reclaiming that slab yields a classic UAF read/disclosure primitive.\nI:H - The dangling work calls at91_vbus_session()/pullup(), which write MMIO through udp_baseaddr and invoke caps-\u003epullup and possibly driver-\u003edisconnect on the freed object, enabling heap corruption and control-flow hijack.\nA:H - Dereferencing the freed udc from timer or workqueue context causes a kernel oops or panic even without a full exploit, so availability impact is High."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-13T06:33:49.071Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a2a602cb1e28d76a5398cec3fa21b0110385f501"
        },
        {
          "url": "https://git.kernel.org/stable/c/51a311eb97e91ce1aed3005cb71ccb2e30f8cce8"
        },
        {
          "url": "https://git.kernel.org/stable/c/557ef547d49ff5e6026a4d39bdd3113bd81d7688"
        },
        {
          "url": "https://git.kernel.org/stable/c/c27d13ce4bab80fbdf6523928071b6c24b37606c"
        }
      ],
      "title": "usb: gadget: at91_udc: drain polled-VBUS timer/work before udc is freed",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89738",
    "datePublished": "2026-09-11T19:46:45.898Z",
    "dateReserved": "2026-09-11T19:38:34.761Z",
    "dateUpdated": "2026-09-13T06:33:49.071Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-89738",
      "date": "2026-09-15",
      "epss": "0.00164",
      "percentile": "0.05937"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-15T01:50:51.000Z",
      "cve": "CVE-2026-89738",
      "id": "msrc_CVE-2026-89738",
      "initial_release_date": "2026-09-13T01:09:23.000Z",
      "product_status:known_not_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "usb: gadget: at91_udc: drain polled-VBUS timer/work before udc is freed",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-89738.json",
      "version": "3"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-89738\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-09-11T20:20:04.357\",\"lastModified\":\"2026-09-13T07:17:38.550\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nusb: gadget: at91_udc: drain polled-VBUS timer/work before udc is freed\\n\\nIn polled-VBUS mode (board.vbus_pin \u0026\u0026 board.vbus_polled), probe arms a\\nself-restarting cycle: at91_vbus_timer() schedules vbus_timer_work, and\\nat91_vbus_timer_work() calls at91_vbus_update() and re-arms the timer via\\nmod_timer(). Both recover the same udc through container_of and dereference\\nit on every iteration.\\n\\nNeither teardown path cancels this cycle. udc is devm-allocated, so it is\\nfreed after at91udc_remove() returns, and is likewise freed when probe\\nfails and devres runs. A timer callback or work item that is pending or\\nrunning at either point dereferences the freed udc.\\n\\nAdd at91_udc_shutdown_vbus_timer() and call it from at91udc_remove() and\\nfrom the usb_add_gadget_udc() failure path in probe; the remaining probe\\nerror paths fail before the timer is armed. timer_shutdown_sync() waits\\nfor a running callback and clears timer-\u003efunction, which makes the work\\nhandler\u0027s mod_timer() a permanent no-op; cancel_work_sync() then drains\\nany pending or running work whose re-arm attempt now does nothing. The\\ntimer must be shut down first, since cancelling the work alone would let\\nthe timer re-queue it. The guard mirrors probe: in IRQ mode the timer and\\nwork_struct are never initialized.\\n\\nThis does not require a fault; a normal driver unbind can interleave with\\nan already queued work item.\\n\\nThis issue was found by an in-house static analysis tool.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/usb/gadget/udc/at91_udc.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4037242c4f5ff77afe61bf07ca1e8a99490219e5\",\"lessThan\":\"a2a602cb1e28d76a5398cec3fa21b0110385f501\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4037242c4f5ff77afe61bf07ca1e8a99490219e5\",\"lessThan\":\"51a311eb97e91ce1aed3005cb71ccb2e30f8cce8\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4037242c4f5ff77afe61bf07ca1e8a99490219e5\",\"lessThan\":\"557ef547d49ff5e6026a4d39bdd3113bd81d7688\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4037242c4f5ff77afe61bf07ca1e8a99490219e5\",\"lessThan\":\"c27d13ce4bab80fbdf6523928071b6c24b37606c\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/usb/gadget/udc/at91_udc.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"2.6.36\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"2.6.36\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.109\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.50\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2.4\",\"lessThanOrEqual\":\"7.2.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.3-rc1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/51a311eb97e91ce1aed3005cb71ccb2e30f8cce8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/557ef547d49ff5e6026a4d39bdd3113bd81d7688\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/a2a602cb1e28d76a5398cec3fa21b0110385f501\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/c27d13ce4bab80fbdf6523928071b6c24b37606c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-13T06:47:51+00:00",
      "cve": "CVE-2026-89738",
      "id": "CVE-2026-89738",
      "initial_release_date": "2026-09-11T19:46:45.898000+00:00",
      "product_status:known_affected": "2",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Linux kernel: USB gadget `at91_udc` driver use-after-free vulnerability",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89738.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-15T23:59:30Z",
      "cve": "CVE-2026-89738",
      "id": "CVE-2026-89738",
      "initial_release_date": "2026-09-12T16:22:31Z",
      "product_status:known_affected": "324",
      "product_status:known_not_affected": "29",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-89738",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-89738.json",
      "version": "4"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.