CVE-2026-98757 - Vulnerability Details

- usb: cdns3: fix use-after-free in cdns3_gadget_exit()

Description

In the Linux kernel, the following vulnerability has been resolved:

usb: cdns3: fix use-after-free in cdns3_gadget_exit()

cdns3_gadget_start() arms two works on system_freezable_wq:
pending_status_wq for the deferred ep0 status stage and aligned_buf_wq
for realigned request buffers. Both handlers use the cdns3_device the
works are embedded in, and cdns3_pending_setup_status_handler() also
calls the ep0 request completion.

cdns3_gadget_exit() does not wait for these works. It frees all
endpoints and aligned buffers and drops the last reference to the
gadget device, which frees priv_dev, so a work queued before the exit
can run after the free.

Fix this by waiting for both works after the gadget driver is unbound
and the IRQ is freed, when no new work can be queued, and before the
endpoints and buffers are released.

This issue was found by an in-house static analysis tool.

Published: 2026-10-18

Score: 4.1 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The defect originates in the Linux USB composite device driver cdns3. A work queue item scheduled by cdns3_gadget_start() may execute after cdns3_gadget_exit() has freed the underlying gadget device and its private data. The resulting use‑after‑free can corrupt kernel memory or lead to arbitrary kernel code execution. The bug is identified as CWE‑825.

Affected Systems

All variants of the Linux kernel that compile the cdns3 USB gadget driver are affected. No specific version range is listed in the report, so any build that contains the vulnerable code before the commit that introduces the fix is vulnerable.

Risk and Exploitability

The CVSS score is 4.1 and the EPSS score is < 1%, indicating a low likelihood of exploitation. The flaw is only exploitable when a USB gadget driver is loaded and a work item can be scheduled and run after the driver is unbound. The vulnerability is local to the host running the kernel, and no remote exploitation path has been documented. The flaw is not listed in the CISA KEV catalog.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`7733f6c32e36ff9d7adadf40001039bf219b1cbe`	affected	< a980a250de22bb4a487e935176d5f7a6b81f9a02
`7733f6c32e36ff9d7adadf40001039bf219b1cbe`	affected	< 5d148a6afe13db0ba0e7a83e0e355ff5b7d6e3e8
`7733f6c32e36ff9d7adadf40001039bf219b1cbe`	affected	< 8650216d82e7713a0083377ebcc3a2af5978c8a8
`7733f6c32e36ff9d7adadf40001039bf219b1cbe`	affected	< efdf0ddaed01161dc1c1f25382856f2fd1c1f44f
`7733f6c32e36ff9d7adadf40001039bf219b1cbe`	affected	< cc448700db656cceb4b411bf99a2e7132144d035
`7733f6c32e36ff9d7adadf40001039bf219b1cbe`	affected	< 95160fe606e685ff18de1e6ddcbc08289476004e
`7733f6c32e36ff9d7adadf40001039bf219b1cbe`	affected	< 159dada48ee2d53eff46e66a8011d67b2c209bbc
`7733f6c32e36ff9d7adadf40001039bf219b1cbe`	affected	< ebe9b68c396792c15d0ac690d592e449e74ed804

Linux

affected

Version	Status	Constraints
`5.4`	affected	—
`0`	unaffected	< 5.4
`5.10.273`	unaffected	≤ 5.10.*
`5.15.224`	unaffected	≤ 5.15.*
`6.1.191`	unaffected	≤ 6.1.*
`6.6.160`	unaffected	≤ 6.6.*
`6.12.113`	unaffected	≤ 6.12.*
`6.18.56`	unaffected	≤ 6.18.*
`7.2.10`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[7733f6c32e36ff9d7adadf40001039bf219b1cbe,cc448700db656cceb4b411bf99a2e7132144d035)`	affected	code_commit	—
`[7733f6c32e36ff9d7adadf40001039bf219b1cbe,95160fe606e685ff18de1e6ddcbc08289476004e)`	affected	code_commit	—
`[7733f6c32e36ff9d7adadf40001039bf219b1cbe,159dada48ee2d53eff46e66a8011d67b2c209bbc)`	affected	code_commit	—
`[7733f6c32e36ff9d7adadf40001039bf219b1cbe,ebe9b68c396792c15d0ac690d592e449e74ed804)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`5.4`	affected	generic	—
`[0,5.4)`	unaffected	generic	—
`[6.12.113,6.13.0)`	unaffected	semver	—
`[6.18.56,6.19.0)`	unaffected	semver	—
`[7.2.10,7.3.0)`	unaffected	semver	—
`[7.3,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the Linux kernel to a version that includes the patch for cdns3_gadget_exit() shown in the upstream commit.
If an upgrade is not immediately possible, unload or disable the cdns3 USB gadget driver to prevent the vulnerable work queue items from running.
Ensure that systems using the cdns3 USB composite driver are isolated from untrusted devices that could trigger the driver to start and exit.

Generated by OpenCVE AI on October 23, 2026 at 21:59 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4850-1	linux-6.12 security update

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00176.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98757.mbox
https://git.kernel.org/stable/c/159dada48ee2d53eff46e66a8011d67b2c209bbc
https://git.kernel.org/stable/c/5d148a6afe13db0ba0e7a83e0e355ff5b7d6e3e8
https://git.kernel.org/stable/c/8650216d82e7713a0083377ebcc3a2af5978c8a8
https://git.kernel.org/stable/c/95160fe606e685ff18de1e6ddcbc08289476004e
https://git.kernel.org/stable/c/a980a250de22bb4a487e935176d5f7a6b81f9a02
https://git.kernel.org/stable/c/cc448700db656cceb4b411bf99a2e7132144d035
https://git.kernel.org/stable/c/ebe9b68c396792c15d0ac690d592e449e74ed804
https://git.kernel.org/stable/c/efdf0ddaed01161dc1c1f25382856f2fd1c1f44f
https://nvd.nist.gov/vuln/detail/CVE-2026-98757
https://www.cve.org/CVERecord?id=CVE-2026-98757

History

Fri, 30 Oct 2026 12:45:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/5d148a6afe13db0ba0e7a83e0e355ff5b7d6e3e8 https://git.kernel.org/stable/c/8650216d82e7713a0083377ebcc3a2af5978c8a8 https://git.kernel.org/stable/c/a980a250de22bb4a487e935176d5f7a6b81f9a02

Fri, 23 Oct 2026 20:15:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-416

Fri, 23 Oct 2026 12:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-825
References		https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98757.mbox https://nvd.nist.gov/vuln/detail/CVE-2026-98757 https://www.cve.org/CVERecord?id=CVE-2026-98757
Metrics	threat_severity `None`	cvssV3_1 `{'score': 4.1, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Wed, 21 Oct 2026 13:15:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/efdf0ddaed01161dc1c1f25382856f2fd1c1f44f

Sun, 18 Oct 2026 20:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-416

Sun, 18 Oct 2026 16:00:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: usb: cdns3: fix use-after-free in cdns3_gadget_exit() cdns3_gadget_start() arms two works on system_freezable_wq: pending_status_wq for the deferred ep0 status stage and aligned_buf_wq for realigned request buffers. Both handlers use the cdns3_device the works are embedded in, and cdns3_pending_setup_status_handler() also calls the ep0 request completion. cdns3_gadget_exit() does not wait for these works. It frees all endpoints and aligned buffers and drops the last reference to the gadget device, which frees priv_dev, so a work queued before the exit can run after the free. Fix this by waiting for both works after the gadget driver is unbound and the IRQ is freed, when no new work can be queued, and before the endpoints and buffers are released. This issue was found by an in-house static analysis tool.
Title		usb: cdns3: fix use-after-free in cdns3_gadget_exit()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/159dada48ee2d53eff46e66a8011d67b2c209bbc https://git.kernel.org/stable/c/95160fe606e685ff18de1e6ddcbc08289476004e https://git.kernel.org/stable/c/cc448700db656cceb4b411bf99a2e7132144d035 https://git.kernel.org/stable/c/ebe9b68c396792c15d0ac690d592e449e74ed804

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-10-18T15:47:44.486Z

Updated: 2026-10-30T12:39:27.986Z

Reserved: 2026-09-25T10:25:14.368Z

Link: CVE-2026-98757

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-10-18T16:17:29.500

Modified: 2026-10-30T13:21:25.223

Link: CVE-2026-98757

Redhat

Severity : Moderate

Publid Date: 2026-10-18T00:00:00Z

Links: CVE-2026-98757 - Bugzilla

OpenCVE Enrichment

Updated: 2026-10-23T22:00:28Z

Weaknesses

CWE-825
Expired Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity High

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object