CVE-2026-89738 - Vulnerability Details

- usb: gadget: at91_udc: drain polled-VBUS timer/work before udc is freed

Description

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: at91_udc: drain polled-VBUS timer/work before udc is freed

In polled-VBUS mode (board.vbus_pin && board.vbus_polled), probe arms a
self-restarting cycle: at91_vbus_timer() schedules vbus_timer_work, and
at91_vbus_timer_work() calls at91_vbus_update() and re-arms the timer via
mod_timer(). Both recover the same udc through container_of and dereference
it on every iteration.

Neither teardown path cancels this cycle. udc is devm-allocated, so it is
freed after at91udc_remove() returns, and is likewise freed when probe
fails and devres runs. A timer callback or work item that is pending or
running at either point dereferences the freed udc.

Add at91_udc_shutdown_vbus_timer() and call it from at91udc_remove() and
from the usb_add_gadget_udc() failure path in probe; the remaining probe
error paths fail before the timer is armed. timer_shutdown_sync() waits
for a running callback and clears timer->function, which makes the work
handler's mod_timer() a permanent no-op; cancel_work_sync() then drains
any pending or running work whose re-arm attempt now does nothing. The
timer must be shut down first, since cancelling the work alone would let
the timer re-queue it. The guard mirrors probe: in IRQ mode the timer and
work_struct are never initialized.

This does not require a fault; a normal driver unbind can interleave with
an already queued work item.

This issue was found by an in-house static analysis tool.

Published: 2026-09-11

Score: 7.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability is a use‑after‑free in the at91_udc USB gadget driver (CWE‑825). In polled‑VBUS mode, the driver creates a self‑starting timer that repeatedly re‑arms itself. Neither the removal routine nor the probe error paths cancel this cycle. When the driver or work handler still runs and accesses the released structure, it simply crashes the kernel, which results in a denial of service to the local system.

Affected Systems

Linux kernels that include the at91 module polled‑VBUS mode (.vbus_polled set). All distributions or embedded builds shipping this driver with polled‑VBUS enabled fall under the scope of the vulnerability.

Risk and Exploitability

The CVSS score of 7.8 classifies the issue as high severity. The EPSS score of less than 1% indicates it is not listed in the CISA KEV catalog. Based on the description, it is inferred that exploitation requires local access to the device while the timer is active or to cause denial of service by crashing the kernel, and remote exploitation is not supported.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`4037242c4f5ff77afe61bf07ca1e8a99490219e5`	affected	< a2a602cb1e28d76a5398cec3fa21b0110385f501
`4037242c4f5ff77afe61bf07ca1e8a99490219e5`	affected	< 51a311eb97e91ce1aed3005cb71ccb2e30f8cce8
`4037242c4f5ff77afe61bf07ca1e8a99490219e5`	affected	< 557ef547d49ff5e6026a4d39bdd3113bd81d7688
`4037242c4f5ff77afe61bf07ca1e8a99490219e5`	affected	< c27d13ce4bab80fbdf6523928071b6c24b37606c

Linux

affected

Version	Status	Constraints
`2.6.36`	affected	—
`0`	unaffected	< 2.6.36
`6.12.109`	unaffected	≤ 6.12.*
`6.18.50`	unaffected	≤ 6.18.*
`7.2.4`	unaffected	≤ 7.2.*
`7.3-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[4037242c4f5ff77afe61bf07ca1e8a99490219e5,a2a602cb1e28d76a5398cec3fa21b0110385f501)`	affected	code_commit	—
`[4037242c4f5ff77afe61bf07ca1e8a99490219e5,51a311eb97e91ce1aed3005cb71ccb2e30f8cce8)`	affected	code_commit	—
`[4037242c4f5ff77afe61bf07ca1e8a99490219e5,557ef547d49ff5e6026a4d39bdd3113bd81d7688)`	affected	code_commit	—
`[4037242c4f5ff77afe61bf07ca1e8a99490219e5,c27d13ce4bab80fbdf6523928071b6c24b37606c)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`2.6.36`	affected	semver	—
`[0,2.6.36)`	unaffected	semver	—
`[6.12.109,6.13.0)`	unaffected	semver	—
`[6.18.50,6.19.0)`	unaffected	semver	—
`[7.2.4,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply a kernel or driver update that includes the at91_udc_shutdown_vbus_timer fix.
Reboot the system to clear any pending timers or work items that may reference the freed driver.
If an update is not possible, disable the at91_udc driver or reconfigure the system to avoid polled‑VBUS mode.

Generated by OpenCVE AI on September 15, 2026 at 21:18 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DSA	DSA-6528-1	linux security update

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00175.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/51a311eb97e91ce1aed3005cb71ccb2e30f8cce8
https://git.kernel.org/stable/c/557ef547d49ff5e6026a4d39bdd3113bd81d7688
https://git.kernel.org/stable/c/a2a602cb1e28d76a5398cec3fa21b0110385f501
https://git.kernel.org/stable/c/c27d13ce4bab80fbdf6523928071b6c24b37606c
https://nvd.nist.gov/vuln/detail/CVE-2026-89738
https://www.cve.org/CVERecord?id=CVE-2026-89738

History

Sun, 13 Sep 2026 06:45:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 4.1, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H'}`	cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

Sat, 12 Sep 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-825
References		https://nvd.nist.gov/vuln/detail/CVE-2026-89738 https://www.cve.org/CVERecord?id=CVE-2026-89738
Metrics	threat_severity `None`	cvssV3_1 `{'score': 4.1, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Fri, 11 Sep 2026 23:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: usb: gadget: at91_udc: drain polled-VBUS timer/work before udc is freed In polled-VBUS mode (board.vbus_pin && board.vbus_polled), probe arms a self-restarting cycle: at91_vbus_timer() schedules vbus_timer_work, and at91_vbus_timer_work() calls at91_vbus_update() and re-arms the timer via mod_timer(). Both recover the same udc through container_of and dereference it on every iteration. Neither teardown path cancels this cycle. udc is devm-allocated, so it is freed after at91udc_remove() returns, and is likewise freed when probe fails and devres runs. A timer callback or work item that is pending or running at either point dereferences the freed udc. Add at91_udc_shutdown_vbus_timer() and call it from at91udc_remove() and from the usb_add_gadget_udc() failure path in probe; the remaining probe error paths fail before the timer is armed. timer_shutdown_sync() waits for a running callback and clears timer->function, which makes the work handler's mod_timer() a permanent no-op; cancel_work_sync() then drains any pending or running work whose re-arm attempt now does nothing. The timer must be shut down first, since cancelling the work alone would let the timer re-queue it. The guard mirrors probe: in IRQ mode the timer and work_struct are never initialized. This does not require a fault; a normal driver unbind can interleave with an already queued work item. This issue was found by an in-house static analysis tool.
Title		usb: gadget: at91_udc: drain polled-VBUS timer/work before udc is freed
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/51a311eb97e91ce1aed3005cb71ccb2e30f8cce8 https://git.kernel.org/stable/c/557ef547d49ff5e6026a4d39bdd3113bd81d7688 https://git.kernel.org/stable/c/a2a602cb1e28d76a5398cec3fa21b0110385f501 https://git.kernel.org/stable/c/c27d13ce4bab80fbdf6523928071b6c24b37606c

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-11T19:46:45.898Z

Updated: 2026-09-13T06:33:49.071Z

Reserved: 2026-09-11T19:38:34.761Z

Link: CVE-2026-89738

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-11T20:20:04.357

Modified: 2026-09-13T07:17:38.550

Link: CVE-2026-89738

Redhat

Severity : Moderate

Publid Date: 2026-09-11T19:46:45Z

Links: CVE-2026-89738 - Bugzilla

OpenCVE Enrichment

Updated: 2026-09-15T21:30:16Z

Weaknesses

CWE-825
Expired Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object