CVE-2026-98766

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: aspeed-vhub: cancel wake work on device removal

wake_work is armed from the gadget .wakeup callback to resume suspended

downstream ports, and it is never cancelled in ast_vhub_remove(), so a

work item queued before or during removal can run after devm has freed

vhub and its ports, a use-after-free.

Cancelling the work alone is not sufficient: usb_gadget_wakeup() takes

no lock and the unbind path never clears wakeup_en, so a remote-wakeup

request in flight on another CPU can re-arm the work after the cancel

and before vhub is freed.

ast_vhub_del_dev() already clears d->registered under vhub->lock before

unregistering the gadget. Refuse the wakeup in ast_vhub_udc_wakeup()

once d->registered is clear: the check and the schedule_work() are then

atomic against the unbind, so a wakeup that passed before the flag was

cleared is drained by the cancel_work_sync() after the del_dev loop,

and one that arrives lat

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References