{"api_version":"1","generated_at":"2026-09-12T10:43:15+00:00","cve":"CVE-2026-89739","urls":{"html":"https://cve.report/CVE-2026-89739","api":"https://cve.report/api/cve/CVE-2026-89739.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-89739","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-89739"},"summary":{"title":"usb: dwc3: gadget: Fix use-after-free in dwc3_gadget_free_endpoints due to race condition","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: dwc3: gadget: Fix use-after-free in dwc3_gadget_free_endpoints due to race condition\n\nIn dwc3_gadget_init_endpoint, &dep->nostream_work is bound with\ndwc3_nostream_work, and dwc3_gadget_endpoint_stream_event can queue\nthis delayed work on system_percpu_wq when a DEPEVT_STREAM_NOSTREAM\nevent is received.\n\nIf we remove the gadget, dwc3_gadget_free_endpoints makes cleanup and\nthe memory allocated for dep with kzalloc() is released by kfree(dep),\nwhile the delayed work mentioned above may still be pending or\nrunning. The sequence of operations that may lead to a UAF bug is as\nfollows:\n\nCPU0                                      CPU1\n\n                                          | dwc3_thread_interrupt\n                                          | dwc3_endpoint_interrupt\n                                          | dwc3_gadget_endpoint_stream_event\n                                          | queue_delayed_work(system_percpu_wq,\n                                          |                    &dep->nostream_work)\ndwc3_gadget_free_endpoints                |\ndwc3_free_trb_pool(dep)                   |\nlist_del(&dep->endpoint.ep_list)          |\ndwc3_debugfs_remove_endpoint_dir(dep)     |\nkfree(dep)                                |\n// dep is freed                           |\n                                          | dwc3_nostream_work\n                                          | // use dep (use-after-free)\n\nFix it by canceling the delayed work before kfree(dep) in\ndwc3_gadget_free_endpoints.","state":"PUBLISHED","assigner":"Linux","published_at":"2026-09-11 20:20:04","updated_at":"2026-09-11 20:20:04"},"problem_types":[],"metrics":[],"references":[{"url":"https://git.kernel.org/stable/c/9c855832790cd488d87de1885974f4c37cfe7358","name":"https://git.kernel.org/stable/c/9c855832790cd488d87de1885974f4c37cfe7358","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/448e95c0f3eaa8d99f16ccae92ab94545f14413b","name":"https://git.kernel.org/stable/c/448e95c0f3eaa8d99f16ccae92ab94545f14413b","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/93e08b13a7a30e4e78556d993720e0bc36231ec7","name":"https://git.kernel.org/stable/c/93e08b13a7a30e4e78556d993720e0bc36231ec7","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-89739","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89739","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected dcfe437492e27d54f3ac491aed024da760f5c43c 448e95c0f3eaa8d99f16ccae92ab94545f14413b git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected dcfe437492e27d54f3ac491aed024da760f5c43c 93e08b13a7a30e4e78556d993720e0bc36231ec7 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected dcfe437492e27d54f3ac491aed024da760f5c43c 9c855832790cd488d87de1885974f4c37cfe7358 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 6.14","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.14 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.18.50 6.18.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.2.4 7.2.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.3-rc1 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/usb/dwc3/gadget.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"448e95c0f3eaa8d99f16ccae92ab94545f14413b","status":"affected","version":"dcfe437492e27d54f3ac491aed024da760f5c43c","versionType":"git"},{"lessThan":"93e08b13a7a30e4e78556d993720e0bc36231ec7","status":"affected","version":"dcfe437492e27d54f3ac491aed024da760f5c43c","versionType":"git"},{"lessThan":"9c855832790cd488d87de1885974f4c37cfe7358","status":"affected","version":"dcfe437492e27d54f3ac491aed024da760f5c43c","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/usb/dwc3/gadget.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.14"},{"lessThan":"6.14","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.50","versionType":"semver"},{"lessThanOrEqual":"7.2.*","status":"unaffected","version":"7.2.4","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.3-rc1","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.18.50","versionStartIncluding":"6.14","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.2.4","versionStartIncluding":"6.14","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.3-rc1","versionStartIncluding":"6.14","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: dwc3: gadget: Fix use-after-free in dwc3_gadget_free_endpoints due to race condition\n\nIn dwc3_gadget_init_endpoint, &dep->nostream_work is bound with\ndwc3_nostream_work, and dwc3_gadget_endpoint_stream_event can queue\nthis delayed work on system_percpu_wq when a DEPEVT_STREAM_NOSTREAM\nevent is received.\n\nIf we remove the gadget, dwc3_gadget_free_endpoints makes cleanup and\nthe memory allocated for dep with kzalloc() is released by kfree(dep),\nwhile the delayed work mentioned above may still be pending or\nrunning. The sequence of operations that may lead to a UAF bug is as\nfollows:\n\nCPU0                                      CPU1\n\n                                          | dwc3_thread_interrupt\n                                          | dwc3_endpoint_interrupt\n                                          | dwc3_gadget_endpoint_stream_event\n                                          | queue_delayed_work(system_percpu_wq,\n                                          |                    &dep->nostream_work)\ndwc3_gadget_free_endpoints                |\ndwc3_free_trb_pool(dep)                   |\nlist_del(&dep->endpoint.ep_list)          |\ndwc3_debugfs_remove_endpoint_dir(dep)     |\nkfree(dep)                                |\n// dep is freed                           |\n                                          | dwc3_nostream_work\n                                          | // use dep (use-after-free)\n\nFix it by canceling the delayed work before kfree(dep) in\ndwc3_gadget_free_endpoints."}],"providerMetadata":{"dateUpdated":"2026-09-11T19:46:46.545Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/448e95c0f3eaa8d99f16ccae92ab94545f14413b"},{"url":"https://git.kernel.org/stable/c/93e08b13a7a30e4e78556d993720e0bc36231ec7"},{"url":"https://git.kernel.org/stable/c/9c855832790cd488d87de1885974f4c37cfe7358"}],"title":"usb: dwc3: gadget: Fix use-after-free in dwc3_gadget_free_endpoints due to race condition","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-89739","datePublished":"2026-09-11T19:46:46.545Z","dateReserved":"2026-09-11T19:38:34.761Z","dateUpdated":"2026-09-11T19:46:46.545Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-09-11 20:20:04","lastModifiedDate":"2026-09-11 20:20:04","problem_types":[],"metrics":[],"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"89739","Ordinal":"1","Title":"usb: dwc3: gadget: Fix use-after-free in dwc3_gadget_free_endpoi","CVE":"CVE-2026-89739","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"89739","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: dwc3: gadget: Fix use-after-free in dwc3_gadget_free_endpoints due to race condition\n\nIn dwc3_gadget_init_endpoint, &dep->nostream_work is bound with\ndwc3_nostream_work, and dwc3_gadget_endpoint_stream_event can queue\nthis delayed work on system_percpu_wq when a DEPEVT_STREAM_NOSTREAM\nevent is received.\n\nIf we remove the gadget, dwc3_gadget_free_endpoints makes cleanup and\nthe memory allocated for dep with kzalloc() is released by kfree(dep),\nwhile the delayed work mentioned above may still be pending or\nrunning. The sequence of operations that may lead to a UAF bug is as\nfollows:\n\nCPU0                                      CPU1\n\n                                          | dwc3_thread_interrupt\n                                          | dwc3_endpoint_interrupt\n                                          | dwc3_gadget_endpoint_stream_event\n                                          | queue_delayed_work(system_percpu_wq,\n                                          |                    &dep->nostream_work)\ndwc3_gadget_free_endpoints                |\ndwc3_free_trb_pool(dep)                   |\nlist_del(&dep->endpoint.ep_list)          |\ndwc3_debugfs_remove_endpoint_dir(dep)     |\nkfree(dep)                                |\n// dep is freed                           |\n                                          | dwc3_nostream_work\n                                          | // use dep (use-after-free)\n\nFix it by canceling the delayed work before kfree(dep) in\ndwc3_gadget_free_endpoints.","Type":"Description","Title":"usb: dwc3: gadget: Fix use-after-free in dwc3_gadget_free_endpoi"}]}}}