Strix
73.3K

CVE-2026-98757

UnknownEPSS 0.17%

Last modified

CVE-2026-98757 is a vulnerability of currently unknown severity. In the Linux kernel, the following vulnerability has been resolved: usb: cdns3: fix use-after-free in cdns3_gadget_exit() cdns3_gadget_start() arms two works on system_freezable_wq: pending_status_wq for the deferred ep0 status stage and aligned_buf_wq for realigned request buffers. Both handlers use the cdns3_device the works are embedded in, and cdns3_pending_setup_status_handler() also calls the ep0 request completion. cdns3_gadget_exit() does not wait for these works. EPSS estimates a 0.17% chance of exploitation in the next 30 days.

Description

In the Linux kernel, the following vulnerability has been resolved: usb: cdns3: fix use-after-free in cdns3_gadget_exit() cdns3_gadget_start() arms two works on system_freezable_wq: pending_status_wq for the deferred ep0 status stage and aligned_buf_wq for realigned request buffers. Both handlers use the cdns3_device the works are embedded in, and cdns3_pending_setup_status_handler() also calls the ep0 request completion. cdns3_gadget_exit() does not wait for these works. It frees all endpoints and aligned buffers and drops the last reference to the gadget device, which frees priv_dev, so a work queued before the exit can run after the free. Fix this by waiting for both works after the gadget driver is unbound and the IRQ is freed, when no new work can be queued, and before the endpoints and buffers are released. This issue was found by an in-house static analysis tool.

Metrics

EPSS Probability
0.17%

6.0th percentile

Probability of exploitation in the next 30 days. Learn more

Affected Software

Source: CNA advisory (CVE.org). NVD analysis pending.

VendorProductVersions
LinuxLinux>= 7733f6c32e36ff9d7adadf40001039bf219b1cbe, < a980a250de22bb4a487e935176d5f7a6b81f9a02; >= 7733f6c32e36ff9d7adadf40001039bf219b1cbe, < 5d148a6afe13db0ba0e7a83e0e355ff5b7d6e3e8; >= 7733f6c32e36ff9d7adadf40001039bf219b1cbe, < 8650216d82e7713a0083377ebcc3a2af5978c8a8; >= 7733f6c32e36ff9d7adadf40001039bf219b1cbe, < efdf0ddaed01161dc1c1f25382856f2fd1c1f44f; >= 7733f6c32e36ff9d7adadf40001039bf219b1cbe, < cc448700db656cceb4b411bf99a2e7132144d035; >= 7733f6c32e36ff9d7adadf40001039bf219b1cbe, < 95160fe606e685ff18de1e6ddcbc08289476004e; >= 7733f6c32e36ff9d7adadf40001039bf219b1cbe, < 159dada48ee2d53eff46e66a8011d67b2c209bbc; >= 7733f6c32e36ff9d7adadf40001039bf219b1cbe, < ebe9b68c396792c15d0ac690d592e449e74ed804
LinuxLinux5.4

References

Timeline

Published
Last Modified
Status
Received

Frequently Asked Questions

What is CVE-2026-98757?
In the Linux kernel, the following vulnerability has been resolved: usb: cdns3: fix use-after-free in cdns3_gadget_exit() cdns3_gadget_start() arms two works on system_freezable_wq: pending_status_wq for the deferred ep0 status stage and aligned_buf_wq for realigned request buffers. Both handlers use the cdns3_device the works are embedded in, and cdns3_pending_setup_status_handler() also calls the ep0 request completion. cdns3_gadget_exit() does not wait for these works. It frees all endpoints and aligned buffers and drops the last reference to the gadget device, which frees priv_dev, so a work queued before the exit can run after the free. Fix this by waiting for both works after the gadget driver is unbound and the IRQ is freed, when no new work can be queued, and before the endpoints and buffers are released. This issue was found by an in-house static analysis tool.
How severe is CVE-2026-98757?
Severity scoring for CVE-2026-98757 is pending analysis. The EPSS model estimates a 0.17% probability of exploitation in the next 30 days.
How do I fix CVE-2026-98757?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2026

View all 2026CVEs →

Are you affected by CVE-2026-98757?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST