In the Linux kernel, the following vulnerability has been resolved: usb: cdns3: fix use-after-free in cdns3_gadget_exit() cdns3_gadget_start() arms… (CVE-2026-98757)

The Linux kernel's usb cdns3 driver had a use-after-free vulnerability in the cdns3_gadget_exit() function. The driver queues deferred work on system_freezable_wq for handling endpoint 0 status and buffer realignment, both referencing the cdns3_device structure. However, cdns3_gadget_exit() did not wait for these deferred works to complete before freeing endpoints, buffers, and the gadget device, which could lead to queued work running after the memory was freed. The fix involves waiting for these works to finish after the gadget driver is unbound and IRQs are freed, preventing use-after-free conditions. This issue was discovered by an internal static analysis tool.

The vulnerability could allow use-after-free conditions in the usb cdns3 driver, potentially leading to memory corruption or kernel instability. No known exploits are reported in the wild. The impact is limited to systems using the affected driver and could affect kernel reliability or security if exploited.

A fix is available that waits for all deferred work to complete before freeing resources in the cdns3 driver. Users should apply the official Linux kernel updates that include this patch. Since this is a kernel-level issue, updating to a patched kernel version is the recommended remediation.