CVE-2026-89733

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: uvc: fix dangling pointers in uvc function bind() and uvc function unbind()

In uvc function bind() error path, we use usb ep free request which uses uvc->control req but does not set it to NULL afterwards. Thus, uvc->control req is a dangling pointer causing a UAF. Also we do not set the uvc->control buf pointer to NULL after freeing it, which is another dangling pointer. Fix it by setting uvc->control req to NULL after we run usb ep free request() and uvc->control buf to NULL after kfree. Do the same for uvc function unbind().