In the Linux kernel, the following vulnerability has been resolved:

USB: dwc2: shut down wakeup timer before freeing HCD state

dwc2 wakeup detected() accesses the DWC2 host state and can rearm the wakeup timer. dwc2 hcd free() currently deletes the timer only after freeing host-owned state, and timer delete() does not synchronize a callback or prevent it from being queued again.

Stop and shut down the timer in dwc2 hcd release(), before the HCD resources are freed. This covers both the HCD initialization error path and normal HCD removal.