CVE-2026-89739

In the Linux kernel, the following vulnerability has been resolved:

usb: dwc3: gadget: Fix use-after-free in dwc3 gadget free endpoints due to race condition

In dwc3 gadget init endpoint, &dep->nostream work is bound with dwc3 nostream work, and dwc3 gadget endpoint stream event can queue this delayed work on system percpu wq when a DEPEVT STREAM NOSTREAM event is received.

If we remove the gadget, dwc3 gadget free endpoints makes cleanup and the memory allocated for dep with kzalloc() is released by kfree(dep), while the delayed work mentioned above may still be pending or running. The sequence of operations that may lead to a UAF bug is as follows:

CPU0 CPU1

                 | dwc3 thread interrupt
                 | dwc3 endpoint interrupt
                 | dwc3 gadget endpoint stream event
                 | queue delayed work(system percpu wq,
                 |          &dep->nostream work)

dwc3 gadget free endpoints | dwc3 free trb pool(dep) | list del(&dep->endpoint.ep list) | dwc3 debugfs remove endpoint dir(dep) | kfree(dep) | // dep is freed | | dwc3 nostream work | // use dep (use-after-free)

Fix it by canceling the delayed work before kfree(dep) in dwc3 gadget free endpoints.