{"id":"CVE-2026-89738","state":"PUBLISHED","title":"usb: gadget: at91_udc: drain polled-VBUS timer/work before udc is freed","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: at91_udc: drain polled-VBUS timer/work before udc is freed\n\nIn polled-VBUS mode (board.vbus_pin && board.vbus_polled), probe arms a\nself-restarting cycle: at91_vbus_timer() schedules vbus_timer_work, and\nat91_vbus_timer_work() calls at91_vbus_update() and re-arms the timer via\nmod_timer(). Both recover the same udc through container_of and dereference\nit on every iteration.\n\nNeither teardown path cancels this cycle. udc is devm-allocated, so it is\nfreed after at91udc_remove() returns, and is likewise freed when probe\nfails and devres runs. A timer callback or work item that is pending or\nrunning at either point dereferences the freed udc.\n\nAdd at91_udc_shutdown_vbus_timer() and call it from at91udc_remove() and\nfrom the usb_add_gadget_udc() failure path in probe; the remaining probe\nerror paths fail before the timer is armed. timer_shutdown_sync() waits\nfor a running callback and clears timer->function, which makes the work\nhandler's mod_timer() a permanent no-op; cancel_work_sync() then drains\nany pending or running work whose re-arm attempt now does nothing. The\ntimer must be shut down first, since cancelling the work alone would let\nthe timer re-queue it. The guard mirrors probe: in IRQ mode the timer and\nwork_struct are never initialized.\n\nThis does not require a fault; a normal driver unbind can interleave with\nan already queued work item.\n\nThis issue was found by an in-house static analysis tool.","publishedAt":"2026-09-11T19:46:45.898Z","updatedAt":"2026-10-30T12:32:52.839Z","severity":{"score":7.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"4037242c4f5ff77afe61bf07ca1e8a99490219e5","status":"affected","lessThan":"2440ce54b8c4c8aa6963c181eb56164a466fbe1c","versionType":"git"},{"version":"4037242c4f5ff77afe61bf07ca1e8a99490219e5","status":"affected","lessThan":"1674e34fe61ad3f5585dc833ba6bb6522912e6a5","versionType":"git"},{"version":"4037242c4f5ff77afe61bf07ca1e8a99490219e5","status":"affected","lessThan":"723d73b245843d4fff4c3f42e857c78c2b2d414e","versionType":"git"},{"version":"4037242c4f5ff77afe61bf07ca1e8a99490219e5","status":"affected","lessThan":"a2a602cb1e28d76a5398cec3fa21b0110385f501","versionType":"git"},{"version":"4037242c4f5ff77afe61bf07ca1e8a99490219e5","status":"affected","lessThan":"51a311eb97e91ce1aed3005cb71ccb2e30f8cce8","versionType":"git"},{"version":"4037242c4f5ff77afe61bf07ca1e8a99490219e5","status":"affected","lessThan":"557ef547d49ff5e6026a4d39bdd3113bd81d7688","versionType":"git"},{"version":"4037242c4f5ff77afe61bf07ca1e8a99490219e5","status":"affected","lessThan":"c27d13ce4bab80fbdf6523928071b6c24b37606c","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/usb/gadget/udc/at91_udc.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"2.6.36","status":"affected"},{"version":"0","status":"unaffected","lessThan":"2.6.36","versionType":"semver"},{"version":"5.15.224","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.191","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.160","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.109","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.50","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.2.4","status":"unaffected","lessThanOrEqual":"7.2.*","versionType":"semver"},{"version":"7.3","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/usb/gadget/udc/at91_udc.c"]}],"references":["https://git.kernel.org/stable/c/2440ce54b8c4c8aa6963c181eb56164a466fbe1c","https://git.kernel.org/stable/c/1674e34fe61ad3f5585dc833ba6bb6522912e6a5","https://git.kernel.org/stable/c/723d73b245843d4fff4c3f42e857c78c2b2d414e","https://git.kernel.org/stable/c/a2a602cb1e28d76a5398cec3fa21b0110385f501","https://git.kernel.org/stable/c/51a311eb97e91ce1aed3005cb71ccb2e30f8cce8","https://git.kernel.org/stable/c/557ef547d49ff5e6026a4d39bdd3113bd81d7688","https://git.kernel.org/stable/c/c27d13ce4bab80fbdf6523928071b6c24b37606c"],"weaknesses":[],"ingestedAt":"2026-10-30T12:52:04.348Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/89xxx/CVE-2026-89738.json","commit":"1f312381e38164a43607eebab851b151dd16861e","baselineCommit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-89738","state":"PUBLISHED","datePublished":"2026-09-11T19:46:45.898Z","dateUpdated":"2026-10-30T12:32:52.839Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-09-11T19:38:34.761Z"},"containers":{"cna":{"title":"usb: gadget: at91_udc: drain polled-VBUS timer/work before udc is freed","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: at91_udc: drain polled-VBUS timer/work before udc is freed\n\nIn polled-VBUS mode (board.vbus_pin && board.vbus_polled), probe arms a\nself-restarting cycle: at91_vbus_timer() schedules vbus_timer_work, and\nat91_vbus_timer_work() calls at91_vbus_update() and re-arms the timer via\nmod_timer(). Both recover the same udc through container_of and dereference\nit on every iteration.\n\nNeither teardown path cancels this cycle. udc is devm-allocated, so it is\nfreed after at91udc_remove() returns, and is likewise freed when probe\nfails and devres runs. A timer callback or work item that is pending or\nrunning at either point dereferences the freed udc.\n\nAdd at91_udc_shutdown_vbus_timer() and call it from at91udc_remove() and\nfrom the usb_add_gadget_udc() failure path in probe; the remaining probe\nerror paths fail before the timer is armed. timer_shutdown_sync() waits\nfor a running callback and clears timer->function, which makes the work\nhandler's mod_timer() a permanent no-op; cancel_work_sync() then drains\nany pending or running work whose re-arm attempt now does nothing. The\ntimer must be shut down first, since cancelling the work alone would let\nthe timer re-queue it. The guard mirrors probe: in IRQ mode the timer and\nwork_struct are never initialized.\n\nThis does not require a fault; a normal driver unbind can interleave with\nan already queued work item.\n\nThis issue was found by an in-house static analysis tool."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"4037242c4f5ff77afe61bf07ca1e8a99490219e5","status":"affected","lessThan":"2440ce54b8c4c8aa6963c181eb56164a466fbe1c","versionType":"git"},{"version":"4037242c4f5ff77afe61bf07ca1e8a99490219e5","status":"affected","lessThan":"1674e34fe61ad3f5585dc833ba6bb6522912e6a5","versionType":"git"},{"version":"4037242c4f5ff77afe61bf07ca1e8a99490219e5","status":"affected","lessThan":"723d73b245843d4fff4c3f42e857c78c2b2d414e","versionType":"git"},{"version":"4037242c4f5ff77afe61bf07ca1e8a99490219e5","status":"affected","lessThan":"a2a602cb1e28d76a5398cec3fa21b0110385f501","versionType":"git"},{"version":"4037242c4f5ff77afe61bf07ca1e8a99490219e5","status":"affected","lessThan":"51a311eb97e91ce1aed3005cb71ccb2e30f8cce8","versionType":"git"},{"version":"4037242c4f5ff77afe61bf07ca1e8a99490219e5","status":"affected","lessThan":"557ef547d49ff5e6026a4d39bdd3113bd81d7688","versionType":"git"},{"version":"4037242c4f5ff77afe61bf07ca1e8a99490219e5","status":"affected","lessThan":"c27d13ce4bab80fbdf6523928071b6c24b37606c","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/usb/gadget/udc/at91_udc.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"2.6.36","status":"affected"},{"version":"0","status":"unaffected","lessThan":"2.6.36","versionType":"semver"},{"version":"5.15.224","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.191","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.160","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.109","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.50","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.2.4","status":"unaffected","lessThanOrEqual":"7.2.*","versionType":"semver"},{"version":"7.3","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/usb/gadget/udc/at91_udc.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/2440ce54b8c4c8aa6963c181eb56164a466fbe1c"},{"url":"https://git.kernel.org/stable/c/1674e34fe61ad3f5585dc833ba6bb6522912e6a5"},{"url":"https://git.kernel.org/stable/c/723d73b245843d4fff4c3f42e857c78c2b2d414e"},{"url":"https://git.kernel.org/stable/c/a2a602cb1e28d76a5398cec3fa21b0110385f501"},{"url":"https://git.kernel.org/stable/c/51a311eb97e91ce1aed3005cb71ccb2e30f8cce8"},{"url":"https://git.kernel.org/stable/c/557ef547d49ff5e6026a4d39bdd3113bd81d7688"},{"url":"https://git.kernel.org/stable/c/c27d13ce4bab80fbdf6523928071b6c24b37606c"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The use-after-free is reached on local AT91 UDC platform-driver teardown (sysfs unbind, rmmod, or probe-error unwind after the polled-VBUS timer is armed), not by parsing USB host packets. That matches other USB gadget/UDC teardown UAFs scored Local and is higher severity than Physical.\nAC:L - Once polled-VBUS mode is active, unbind or the usb_add_gadget_udc() failure path frees the devm-allocated udc while the self-restarting timer/work still hold it; the next timer tick or already-queued work then dereferences the freed object with no race the attacker cannot drive.\nPR:L - Highest reasonable exposure is a local account that manages the USB gadget/UDC on AT91 industrial, IoT, and embedded controllers, where platform unbind or gadget HAL access is often delegated beyond init-namespace root. Uncertain Low vs High, so Low per the overestimate rule.\nUI:N - The attacker initiates driver unbind, module unload, or a failing re-probe themselves; no separate victim action such as plugging a USB cable, mounting a filesystem, or opening a device node is required.\nS:U - The use-after-free corrupts the host kernel's struct at91_udc heap object within the same OS security authority and does not cross a VM, IOMMU, or sandbox boundary.\nC:H - at91_vbus_timer() and at91_vbus_timer_work() recover the freed udc via container_of and read vbus_pin, gadget state, and related fields; reclaiming that slab yields a classic UAF read/disclosure primitive.\nI:H - The dangling work calls at91_vbus_session()/pullup(), which write MMIO through udp_baseaddr and invoke caps->pullup and possibly driver->disconnect on the freed object, enabling heap corruption and control-flow hijack.\nA:H - Dereferencing the freed udc from timer or workqueue context causes a kernel oops or panic even without a full exploit, so availability impact is High."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-10-30T12:32:52.839Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.36","versionEndExcluding":"5.15.224"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.36","versionEndExcluding":"6.1.191"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.36","versionEndExcluding":"6.6.160"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.36","versionEndExcluding":"6.12.109"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.36","versionEndExcluding":"6.18.50"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.36","versionEndExcluding":"7.2.4"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.36","versionEndExcluding":"7.3"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}}}}}