SB20261022365 - Use-after-free in Linux kernel usb cdns3 driver
Published: October 22, 2026
Security Bulletin ID
SB20261022365
CSH Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Local access
Highest impact
Denial of service
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 vulnerability.
1) Use-after-free (CVE-ID: CVE-2026-98757)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to potentially cause a kernel crash and denial of service.
The vulnerability exists due to a use-after-free in cdns3_gadget_exit() in the Linux kernel USB cdns3 gadget driver when tearing down a gadget device with deferred work still queued. A local user can exploit deferred work accessing freed device memory after teardown to potentially cause a kernel crash and denial of service.
Remediation
Install update from vendor's website.
References
- https://git.kernel.org/stable/c/159dada48ee2d53eff46e66a8011d67b2c209bbc
- https://git.kernel.org/stable/c/95160fe606e685ff18de1e6ddcbc08289476004e
- https://git.kernel.org/stable/c/cc448700db656cceb4b411bf99a2e7132144d035
- https://git.kernel.org/stable/c/ebe9b68c396792c15d0ac690d592e449e74ed804
- https://git.kernel.org/stable/c/efdf0ddaed01161dc1c1f25382856f2fd1c1f44f