CVE-2026-98766

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: aspeed-vhub: cancel wake work on device removal

wake work is armed from the gadget .wakeup callback to resume suspended downstream ports, and it is never cancelled in ast vhub remove(), so a work item queued before or during removal can run after devm has freed vhub and its ports, a use-after-free.

Cancelling the work alone is not sufficient: usb gadget wakeup() takes no lock and the unbind path never clears wakeup en, so a remote-wakeup request in flight on another CPU can re-arm the work after the cancel and before vhub is freed.

ast vhub del dev() already clears d->registered under vhub->lock before unregistering the gadget. Refuse the wakeup in ast vhub udc wakeup() once d->registered is clear: the check and the schedule work() are then atomic against the unbind, so a wakeup that passed before the flag was cleared is drained by the cancel work sync() after the del dev loop, and one that arrives later returns without arming. Also move INIT WORK() to the top of ast vhub probe(), since the probe error path reuses ast vhub remove() and would otherwise cancel a never-initialized work item.

This issue was found by an in-house static analysis tool.