In the Linux kernel, the following vulnerability has been resolved: usb: gadget: aspeed-vhub: cancel wake work on device removal wake_work is armed… (CVE-2026-98766)

The Linux kernel usb gadget driver for aspeed-vhub had a use-after-free vulnerability (CVE-2026-98766) caused by the wake_work item not being cancelled in ast_vhub_remove(). This allowed a queued work item to execute after the device and its ports were freed, leading to potential memory corruption. The root cause was that usb_gadget_wakeup() could re-arm the work after cancellation due to lack of locking and the unbind path not clearing wakeup_en. The patch introduced an atomic check of the device's registered state under a lock to refuse wakeup requests after unbinding, ensuring that any wake_work is properly drained before freeing the device. INIT_WORK() was also moved to the probe start to avoid cancelling uninitialized work. The vulnerability was found by an internal static analysis tool. No CVSS score or known exploits are reported.

This vulnerability could lead to use-after-free conditions in the Linux kernel usb gadget driver, potentially causing kernel memory corruption or instability. However, no known exploits in the wild have been reported. The impact is limited to systems running the affected usb gadget driver for aspeed-vhub.

A fix for this vulnerability has been implemented in the Linux kernel by cancelling the wake_work item atomically during device removal and refusing wakeup requests once the device is unregistered. Users should apply the official kernel update containing this patch when available. Patch status is not explicitly confirmed in the provided data; check the vendor advisory or Linux kernel mailing lists for the exact fixed versions and update guidance.