medium · CVSS v3 5.5

CVE-2026-98766

A use‑after‑free in the Linux kernel’s aspeed‑vhub USB gadget can trigger after device removal, potentially leading to a crash or privilege

Overview

A use‑after‑free in the Linux kernel’s aspeed‑vhub USB gadget can trigger after device removal, potentially leading to a crash or privilege escalation. It affects systems running the aspeed‑vhub driver.

Description

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: aspeed-vhub: cancel wake work on device removal wake_work is armed from the gadget .wakeup callback to resume suspended downstream ports, and it is never cancelled in ast_vhub_remove(), so a work item queued before or during removal can run after devm has freed vhub and its ports, a use-after-free. Cancelling the work alone is not sufficient: usb_gadget_wakeup() takes no lock and the unbind path never clears wakeup_en, so a remote-wakeup request in flight on another CPU can re-arm the work after the cancel and before vhub is freed. ast_vhub_del_dev() already clears d->registered under vhub->lock before unregistering the gadget. Refuse the wakeup in ast_vhub_udc_wakeup() once d->registered is clear: the check and the schedule_work() are then atomic against the unbind, so a wakeup that passed before the flag was cleared is drained by the cancel_work_sync() after the del_dev loop, and one that arrives later returns without arming. Also move INIT_WORK() to the top of ast_vhub_probe(), since the probe error path reuses ast_vhub_remove() and would otherwise cancel a never-initialized work item. This issue was found by an in-house static analysis tool.

Impact

The vulnerability can cause a kernel crash or arbitrary code execution, compromising confidentiality, integrity, and availability of the host. Attackers with local or remote access to the USB subsystem could exploit it. Defenders should treat it as a medium‑risk flaw that may allow privilege escalation.

Remediation

Apply the official kernel patch that cancels wake_work during removal and clears wakeup_en before unbinding. Update to a kernel version that includes the fix (e.g., 6.8+). If unable to patch, disable the aspeed‑vhub gadget or block USB gadget functionality until patched.

Risk context

Medium severity (CVSS 5.5) with no EPSS data. The flaw is not immediately exploitable without a crafted USB device, but it remains a moderate risk for systems that expose the aspeed‑vhub driver.

Affected products

  • Linux kernel
  • aspeed‑vhub gadget
  • USB gadget driver
  • embedded devices with aspeed chipset

Scores

Severity
medium
CVSS v2
4.9
CVSS v3
5.5
CVSS v4
—
EPSS
—

kernel usb use-after-free aspeed-vhub device-removal patch defense

← All CVEs

Related CVEs

medium

CVE-2026-98723

In the Linux kernel, the following vulnerability has been resolved: nvmet: copy the hostid into the ctrl before creating PR pc_refs Commit 6202783184bf ("nvmet: Improve nvmet_alloc_ctrl() interface and implementation") added a second uuid_copy() of args->hostid near the end of nvmet_alloc_ctrl(), and commit 7b658153f1b8 ("nvmet: Remove duplicate uuid_copy") removed the original copy that sat before nvmet_ctrl_init_pr() instead of the new one. Since then nvmet_ctrl_init_pr() snapshots ctrl->hostid into the per-controller per-namespace reservation refs while the uuid_copy() from the connect data runs later, after the controller is published. The ctrl is allocated with kzalloc(), so every pc_ref created on this path stores the nil UUID. pc_ref->hostid has a single consumer: nvmet_pr_set_ctrl_to_abort() matches it against the preempted registrant's hostid to kill and drain the victim's in-flight I/O for Preempt and Abort. The match can never hit with the nil UUID, so whenever a namespace with reservations enabled exists before a host connects, which includes every reconnect, Preempt and Abort silently degrades into a plain Preempt: the preempting host sees success while the victim's in-flight I/O is still in the air. Copy the hostid where the rest of the connect data is consumed, before the controller is published and before nvmet_ctrl_init_pr() takes its snapshot.

View analysis

medium

CVE-2026-98676

In the Linux kernel, the following vulnerability has been resolved: iio: adc: ade9000: fix NULL pointer dereference in clkout registration ade9000_setup_clkout() passes NULL as the register address when registering a divider clock. During clock registration, the common clock framework calls clk_divider_recalc_rate(), which dereferences the address through readl(). As a result, probing an ADE9000 configured as a clock provider with an external input clock crashes. CLKOUT passes CLKIN through without changing its rate. Register it as a 1:1 fixed-factor clock, which does not require register access. This change does not affect the configuration using the internal clock, for which the driver does not register a clock provider.

View analysis

medium

CVE-2026-98678

A Linux kernel iio ADC driver for the AD4030 had an input validation flaw that allowed zero or negative oversampling ratios to be processed, potentially causing undefined behavior. The issue was fixed by validating the value before computing its logarithm. This matters because it could lead to kernel instability or incorrect ADC data on affected systems.

View analysis

medium

CVE-2026-98680

In the Linux kernel, the following vulnerability has been resolved: iio: accel: kionix-kx022a: Prevent memory leak and fix state The driver allocates memory for samples at buffer enable path. If regmap operation fails in the kx022a_fifo_enable() at the buffer enable path, the allocated memory is never freed. Furthermore, the state information and previous hardware configuration(s) aren't undone, potentially leaving WMI interrupts and buffers enabled, or driver state flags wrong. Free the memory and revert the hardware configuration and state flags on error path.

View analysis