CVE-2026-89738

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: at91_udc: drain polled-VBUS timer/work before udc is freed

In polled-VBUS mode (board.vbus_pin && board.vbus_polled), probe arms a

self-restarting cycle: at91_vbus_timer() schedules vbus_timer_work, and

at91_vbus_timer_work() calls at91_vbus_update() and re-arms the timer via

mod_timer(). Both recover the same udc through container_of and dereference

it on every iteration.

Neither teardown path cancels this cycle. udc is devm-allocated, so it is

freed after at91udc_remove() returns, and is likewise freed when probe

fails and devres runs. A timer callback or work item that is pending or

running at either point dereferences the freed udc.

Add at91_udc_shutdown_vbus_timer() and call it from at91udc_remove() and

from the usb_add_gadget_udc() failure path in probe; the remaining probe

error paths fail before the timer is armed. timer_shutdown_sync() waits

for a running callback and clears timer->function, w

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References