CVE-2026-89739
In the Linux kernel, the following vulnerability has been resolved:
usb: dwc3: gadget: Fix use-after-free in dwc3_gadget_free_endpoints due to race condition
In dwc3_gadget_init_endpoint, &dep->nostream_work is bound with dwc3_nostream_work, and dwc3_gadget_endpoint_stream_event can queue this delayed work on system_percpu_wq when a DEPEVT_STREAM_NOSTREAM event is received.
If we remove the gadget, dwc3_gadget_free_endpoints makes cleanup and the memory allocated for dep with kzalloc() is released by kfree(dep), while the delayed work mentioned above may still be pending or running. The sequence of operations that may lead to a UAF bug is as follows:
Leer descripción completaMostrar menos
CPU0 CPU1
Fix it by canceling the delayed work before kfree(dep) in dwc3_gadget_free_endpoints.
Detalles técnicos trazas, registros y código del informe original
| dwc3_thread_interrupt
| dwc3_endpoint_interrupt
| dwc3_gadget_endpoint_stream_event
| queue_delayed_work(system_percpu_wq,
| &dep->nostream_work)
dwc3_gadget_free_endpoints |
dwc3_free_trb_pool(dep) |
list_del(&dep->endpoint.ep_list) |
dwc3_debugfs_remove_endpoint_dir(dep) |
kfree(dep) |
// dep is freed |
| dwc3_nostream_work
| // use dep (use-after-free)CVSS
NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 0.21%
- Percentil entre todas las CVEs puntuadas: 10
- Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (1)
⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.
Referencias
JSON original (NVD)
Mostrar
{
"id": "CVE-2026-89739",
"cveTags": [],
"metrics": {},
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "f41ffcd656615754741f190afca00ca3c4bde9f1",
"lessThan": "5f359265f616873edf32db418bd1513fdae3ddec",
"versionType": "git"
},
{
"status": "affected",
"version": "dcfe437492e27d54f3ac491aed024da760f5c43c",
"lessThan": "448e95c0f3eaa8d99f16ccae92ab94545f14413b",
"versionType": "git"
},
{
"status": "affected",
"version": "dcfe437492e27d54f3ac491aed024da760f5c43c",
"lessThan": "93e08b13a7a30e4e78556d993720e0bc36231ec7",
"versionType": "git"
},
{
"status": "affected",
"version": "dcfe437492e27d54f3ac491aed024da760f5c43c",
"lessThan": "9c855832790cd488d87de1885974f4c37cfe7358",
"versionType": "git"
}
],
"programFiles": [
"drivers/usb/dwc3/gadget.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "6.14"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "6.14",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.18.50",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.2.4",
"versionType": "semver",
"lessThanOrEqual": "7.2.*"
},
{
"status": "unaffected",
"version": "7.3-rc1",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"drivers/usb/dwc3/gadget.c"
],
"defaultStatus": "affected"
}
]
}
],
"published": "2026-09-11T20:20:04.480",
"references": [
{
"url": "https://git.kernel.org/stable/c/448e95c0f3eaa8d99f16ccae92ab94545f14413b",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/5f359265f616873edf32db418bd1513fdae3ddec",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/93e08b13a7a30e4e78556d993720e0bc36231ec7",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/9c855832790cd488d87de1885974f4c37cfe7358",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: dwc3: gadget: Fix use-after-free in dwc3_gadget_free_endpoints due to race condition\n\nIn dwc3_gadget_init_endpoint, &dep->nostream_work is bound with\ndwc3_nostream_work, and dwc3_gadget_endpoint_stream_event can queue\nthis delayed work on system_percpu_wq when a DEPEVT_STREAM_NOSTREAM\nevent is received.\n\nIf we remove the gadget, dwc3_gadget_free_endpoints makes cleanup and\nthe memory allocated for dep with kzalloc() is released by kfree(dep),\nwhile the delayed work mentioned above may still be pending or\nrunning. The sequence of operations that may lead to a UAF bug is as\nfollows:\n\nCPU0 CPU1\n\n | dwc3_thread_interrupt\n | dwc3_endpoint_interrupt\n | dwc3_gadget_endpoint_stream_event\n | queue_delayed_work(system_percpu_wq,\n | &dep->nostream_work)\ndwc3_gadget_free_endpoints |\ndwc3_free_trb_pool(dep) |\nlist_del(&dep->endpoint.ep_list) |\ndwc3_debugfs_remove_endpoint_dir(dep) |\nkfree(dep) |\n// dep is freed |\n | dwc3_nostream_work\n | // use dep (use-after-free)\n\nFix it by canceling the delayed work before kfree(dep) in\ndwc3_gadget_free_endpoints."
}
],
"lastModified": "2026-10-03T11:17:43.010",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}