Description
In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: aspeed-vhub: cancel wake work on device removal

wake_work is armed from the gadget .wakeup callback to resume suspended
downstream ports, and it is never cancelled in ast_vhub_remove(), so a
work item queued before or during removal can run after devm has freed
vhub and its ports, a use-after-free.

Cancelling the work alone is not sufficient: usb_gadget_wakeup() takes
no lock and the unbind path never clears wakeup_en, so a remote-wakeup
request in flight on another CPU can re-arm the work after the cancel
and before vhub is freed.

ast_vhub_del_dev() already clears d->registered under vhub->lock before
unregistering the gadget. Refuse the wakeup in ast_vhub_udc_wakeup()
once d->registered is clear: the check and the schedule_work() are then
atomic against the unbind, so a wakeup that passed before the flag was
cleared is drained by the cancel_work_sync() after the del_dev loop,
and one that arrives later returns without arming. Also move INIT_WORK()
to the top of ast_vhub_probe(), since the probe error path reuses
ast_vhub_remove() and would otherwise cancel a never-initialized work
item.

This issue was found by an in-house static analysis tool.
Published: 2026-10-18
Score: 4.1 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Use After Free leading to potential code execution or denial of service
Action: Patch Immediately
AI Analysis

Impact

The Linux kernel gadget driver aspeed‑vhub schedules a wake_work item when a USB gadget wakes a remote device. The work item is never cancelled when the virtual hub is removed; therefore, a queued work item can execute after the hub and its ports have been freed, causing a use‑after‑free error. This flaw permits an attacker to trigger memory corruption, which may lead to arbitrary code execution or a system crash. The weakness is a classic use‑after‑free violation, identified as CWE‑825.

Affected Systems

All Linux kernels containing the aspeed‑vhub gadget driver are affected. The specific kernel releases are not listed in the advisory, so any kernel that includes this driver before the patch is vulnerable. Check the kernel version you run against the upstream commit that applies the fix referenced in the kernel git logs.

Risk and Exploitability

The CVE has a CVSS score of 4.1, an EPSS score of < 1% and is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack requires triggering device removal or a wake‑up event while the gadget is active, which may need local access or the ability to manipulate USB devices. Even though the risk level cannot be quantified, the damage potential of a use‑after‑free is high, therefore it should be treated with priority.

Generated by OpenCVE AI on October 23, 2026 at 19:45 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Immediately update the Linux kernel to a version that includes the bug fix; if you build your own kernel, apply the upstream commit(s) from the provided git URLs.
  • If an immediate kernel upgrade is not possible, prevent the vulnerable driver from being loaded by blacklisting the aspeed‑vhub module or disabling its build configuration so the system will not use the gadget driver even when a USB device is attached.
  • If the system relies on a distribution‑provided kernel and you cannot control the build, request an updated kernel from your vendor or distribution maintainer and monitor for any release that incorporates the fix.

Generated by OpenCVE AI on October 23, 2026 at 19:45 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4850-1 linux-6.12 security update
History

Fri, 30 Oct 2026 13:00:00 +0000

Type Values Removed Values Added
References

Fri, 23 Oct 2026 18:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-416

Fri, 23 Oct 2026 12:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-825
References
Metrics threat_severity

None

 cvssV3_1

{'score': 4.1, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Moderate

Wed, 21 Oct 2026 13:15:00 +0000

Type Values Removed Values Added
References

Sun, 18 Oct 2026 23:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-416

Sun, 18 Oct 2026 16:00:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: usb: gadget: aspeed-vhub: cancel wake work on device removal wake_work is armed from the gadget .wakeup callback to resume suspended downstream ports, and it is never cancelled in ast_vhub_remove(), so a work item queued before or during removal can run after devm has freed vhub and its ports, a use-after-free. Cancelling the work alone is not sufficient: usb_gadget_wakeup() takes no lock and the unbind path never clears wakeup_en, so a remote-wakeup request in flight on another CPU can re-arm the work after the cancel and before vhub is freed. ast_vhub_del_dev() already clears d->registered under vhub->lock before unregistering the gadget. Refuse the wakeup in ast_vhub_udc_wakeup() once d->registered is clear: the check and the schedule_work() are then atomic against the unbind, so a wakeup that passed before the flag was cleared is drained by the cancel_work_sync() after the del_dev loop, and one that arrives later returns without arming. Also move INIT_WORK() to the top of ast_vhub_probe(), since the probe error path reuses ast_vhub_remove() and would otherwise cancel a never-initialized work item. This issue was found by an in-house static analysis tool.
Title usb: gadget: aspeed-vhub: cancel wake work on device removal
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-10-30T12:39:35.461Z

Reserved: 2026-09-25T10:25:14.368Z

Link: CVE-2026-98766

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-18T16:17:30.440

Modified: 2026-10-30T13:21:26.200

Link: CVE-2026-98766

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-10-18T00:00:00Z

Links: CVE-2026-98766 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-23T20:00:16Z

Weaknesses
  • CWE-825

    Expired Pointer Dereference