The vulnerability in the Linux kernel's at91_udc USB gadget driver arises from a polled-VBUS timer and associated work item that repeatedly access the same udc structure via container_of. When the driver is removed or probe fails, the udc is freed without cancelling this timer/work cycle, causing a use-after-free. The patch adds a shutdown function that synchronously stops the timer and cancels any pending work before freeing the udc, ensuring no callbacks dereference freed memory. This flaw does not require a fault to trigger; normal driver unbind can race with queued work. The issue was discovered by an internal static analysis tool.

Dereferencing freed memory can lead to undefined behavior including kernel crashes or potential escalation of privileges if exploited. However, there are no known exploits in the wild. The flaw affects the stability and security of the affected USB gadget driver in the Linux kernel.

A fix is available that properly shuts down the polled-VBUS timer and cancels pending work before freeing the udc structure. Users should apply the official Linux kernel patches that include this fix. No additional mitigation is required beyond applying the patch.