In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: gadget: Fix use-after-free in dwc3_gadget_free_endpoints due to race… (CVE-2026-89739)
A use-after-free vulnerability in the Linux kernel's USB dwc3 gadget driver was fixed. The issue occurs due to a race condition where delayed work referencing freed memory may still execute after the memory is released. The fix involves canceling the delayed work before freeing the associated memory.
AI Analysis
Technical Summary
The vulnerability in the Linux kernel's dwc3 USB gadget driver arises from a race condition between freeing endpoint resources and delayed work execution. Specifically, dwc3_gadget_free_endpoints frees memory allocated for endpoint structures (dep) while a delayed work item (dep->nostream_work) may still be queued or running on the system_percpu_wq workqueue. This leads to a use-after-free (UAF) bug when the delayed work handler accesses the freed memory. The fix cancels the delayed work before freeing the memory to prevent this UAF condition.
Potential Impact
The use-after-free condition could lead to kernel memory corruption, potentially causing system instability or crashes. The vulnerability affects the USB gadget functionality of the Linux kernel, which could impact devices using the dwc3 driver. No known exploits in the wild have been reported.
Mitigation Recommendations
A fix is available that cancels the delayed work before freeing the endpoint memory in dwc3_gadget_free_endpoints. Users should apply the official Linux kernel patch that addresses this race condition to prevent the use-after-free vulnerability.
In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: gadget: Fix use-after-free in dwc3_gadget_free_endpoints due to race… (CVE-2026-89739)
Description
A use-after-free vulnerability in the Linux kernel's USB dwc3 gadget driver was fixed. The issue occurs due to a race condition where delayed work referencing freed memory may still execute after the memory is released. The fix involves canceling the delayed work before freeing the associated memory.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in the Linux kernel's dwc3 USB gadget driver arises from a race condition between freeing endpoint resources and delayed work execution. Specifically, dwc3_gadget_free_endpoints frees memory allocated for endpoint structures (dep) while a delayed work item (dep->nostream_work) may still be queued or running on the system_percpu_wq workqueue. This leads to a use-after-free (UAF) bug when the delayed work handler accesses the freed memory. The fix cancels the delayed work before freeing the memory to prevent this UAF condition.
Potential Impact
The use-after-free condition could lead to kernel memory corruption, potentially causing system instability or crashes. The vulnerability affects the USB gadget functionality of the Linux kernel, which could impact devices using the dwc3 driver. No known exploits in the wild have been reported.
Mitigation Recommendations
A fix is available that cancels the delayed work before freeing the endpoint memory in dwc3_gadget_free_endpoints. Users should apply the official Linux kernel patch that addresses this race condition to prevent the use-after-free vulnerability.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-5q8g-48x9-ppw2
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-89739"]
Threat ID: 6aa49ffb55bf5e2cf5a865d8
Added to database: 09/12/2026, 00:42:35 UTC
Last enriched: 09/12/2026, 00:50:49 UTC
Last updated: 09/12/2026, 00:50:49 UTC
Views: 1
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.