Use-after-free in Linux kernel - CVE-2026-89739

Vulnerability details

The vulnerability allows a local privileged user to trigger a use-after-free condition.

The vulnerability exists due to a race condition in dwc3_gadget_free_endpoints when a stream no-stream event is processed while gadget endpoints are being removed. A local privileged user can cause delayed work to access an endpoint after its memory has been freed to trigger a use-after-free condition.

Affected software

How to mitigate CVE-2026-89739

External References

• https://git.kernel.org/stable/c/448e95c0f3eaa8d99f16ccae92ab94545f14413b
• https://git.kernel.org/stable/c/93e08b13a7a30e4e78556d993720e0bc36231ec7
• https://git.kernel.org/stable/c/9c855832790cd488d87de1885974f4c37cfe7358

Related Security Bulletins

• Use-after-free in Linux kernel usb dwc3 driver