In the Linux kernel, the following vulnerability has been resolved:

usb: cdns3: fix use-after-free in cdns3 gadget exit()

cdns3 gadget start() arms two works on system freezable wq: pending status wq for the deferred ep0 status stage and aligned buf wq for realigned request buffers. Both handlers use the cdns3 device the works are embedded in, and cdns3 pending setup status handler() also calls the ep0 request completion.

cdns3 gadget exit() does not wait for these works. It frees all endpoints and aligned buffers and drops the last reference to the gadget device, which frees priv dev, so a work queued before the exit can run after the free.

Fix this by waiting for both works after the gadget driver is unbound and the IRQ is freed, when no new work can be queued, and before the endpoints and buffers are released.

This issue was found by an in-house static analysis tool.