Look up another CVE · open CVE-2026-89738 in the interactive tracker
CVE-2026-89738
usb: gadget: at91_udc: drain polled-VBUS timer/work before udc is freed
Published 2026-09-11 (37 days ago) by the Linux kernel CNA. Subsystem drivers/usb. Debian urgency: not yet assigned.
Debian does not build this code. The per-release build detail is under "Where it lives" below.
What to do, per Debian release
Debian's own status for CVE-2026-89738 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | vulnerable | 6.1.190-1 | No fix published anywhere yet, neither in Debian nor upstream for the series bookworm tracks. Watch the Debian tracker page for this CVE. Advisories for bookworm have historically landed a median of 23 days after publication. |
| Debian 13trixie | fixedDSA-6528-1 · 2026-09-29 · text | 6.12.111-1 | Update the kernel and reboot. DSA-6528-1 shipped the fix on 2026-09-29, in 6.12.111-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.2.6-1 | Update the kernel and reboot. Fixed in 7.2.6-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.2.6-1 | Update the kernel and reboot. Fixed in 7.2.6-1. A running kernel keeps the old code until the machine restarts. |
| Debian 12bookworm · linux-6.12 | fixedDLA-4817-1 · 2026-10-04 · text | 6.12.111-1~deb12u1 | Update the kernel and reboot. DLA-4817-1 shipped the fix on 2026-10-04, in 6.12.111-1~deb12u1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
In polled-VBUS mode (board.vbus_pin && board.vbus_polled), probe arms a self-restarting cycle: at91_vbus_timer() schedules vbus_timer_work, and at91_vbus_timer_work() calls at91_vbus_update() and re-arms the timer via mod_timer(). Both recover the same udc through container_of and dereference it on every iteration. Neither teardown path cancels this cycle. udc is devm-allocated, so it is freed after at91udc_remove() returns, and is likewise freed when probe fails and devres runs. A timer callback or work item that is pending or running at either point dereferences the freed udc. Add at91_udc_shutdown_vbus_timer() and call it from at91udc_remove() and from the usb_add_gadget_udc() failure path in probe; the remaining probe error paths fail before the timer is armed. timer_shutdown_sync() waits for a running callback and clears timer->function, which makes the work handler's mod_timer() a permanent no-op; cancel_work_sync() then drains any pending or running work whose re-arm attempt now does nothing. The timer must be shut down first, since cancelling the work alone would let the timer re-queue it. The guard mirrors probe: in IRQ mode the timer and work_struct are never initialized. This does not require a fault; a normal driver unbind can interleave with an already queued work item. This issue was found by an in-house static analysis tool.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
drivers/usb/gadget/udc/at91_udc.c
- What this is
- USB SUBSYSTEMMAINTAINERS section matched on drivers/usb/ · linux-usb@vger.kernel.org · Supported
- Kernel module
- none to look for. The file would have gone into at91_udc, and Debian does not compile it into that module, so finding at91_udc in lsmod would say nothing about this CVE.
Check it on the machine
grep -wE 'CONFIG_OF|CONFIG_PCI|CONFIG_USB|CONFIG_USB_AT91|CONFIG_USB_GADGET|CONFIG_USB_PHY|CONFIG_USB_SUPPORT' /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
Show whether Debian builds this, per release
Debian does not build this code. In 5 releases below, every kernel flavour Debian publishes has the switch off, so the vulnerable file is compiled into no kernel binary Debian ships.
- bookworm, trixie, forky, sid, bookworm · linux-6.12n
- n
- not enabled on any flavour - this release does not build the code
- Build switches
- CONFIG_OF, CONFIG_PCI, CONFIG_USB, CONFIG_USB_AT91, CONFIG_USB_GADGET, CONFIG_USB_PHY, CONFIG_USB_SUPPORT
- Reads as
- all on means the file is compiled; any one off means it is not.
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-09-11 (37 days ago)source
- CVSS
- 7.8 high
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- local (AV:L)source
- EPSS
- 0.17%, higher than 5.8% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- drivers/usb
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 2.6.36 | 6.12.109 | a2a602cb1e28 |
| 2.6.36 | 6.18.50 | 51a311eb97e9 |
| 2.6.36 | 7.2.4 | 557ef547d49f |
| 2.6.36 | 7.3 | c27d13ce4bab |
Debian advisories
| Advisory | Date | Shipped to | Debian |
|---|---|---|---|
| DLA-4817-1 | 2026-10-04 | bookworm 6.12.111-1~deb12u1 | tracker |
| DSA-6528-1 | 2026-09-29 | trixie 6.12.111-1 | tracker |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:LAttack vector, local
- The use-after-free is reached on local AT91 UDC platform-driver teardown (sysfs unbind, rmmod, or probe-error unwind after the polled-VBUS timer is armed), not by parsing USB host packets. That matches other USB gadget/UDC teardown UAFs scored Local and is higher severity than Physical.
- AC:LAttack complexity, low
- Once polled-VBUS mode is active, unbind or the usb_add_gadget_udc() failure path frees the devm-allocated udc while the self-restarting timer/work still hold it; the next timer tick or already-queued work then dereferences the freed object with no race the attacker cannot drive.
- PR:LPrivileges required, low
- Highest reasonable exposure is a local account that manages the USB gadget/UDC on AT91 industrial, IoT, and embedded controllers, where platform unbind or gadget HAL access is often delegated beyond init-namespace root. Uncertain Low vs High, so Low per the overestimate rule.
- UI:NUser interaction, none
- The attacker initiates driver unbind, module unload, or a failing re-probe themselves; no separate victim action such as plugging a USB cable, mounting a filesystem, or opening a device node is required.
- S:UScope, unchanged
- The use-after-free corrupts the host kernel's struct at91_udc heap object within the same OS security authority and does not cross a VM, IOMMU, or sandbox boundary.
- C:HConfidentiality impact, high
- at91_vbus_timer() and at91_vbus_timer_work() recover the freed udc via container_of and read vbus_pin, gadget state, and related fields; reclaiming that slab yields a classic UAF read/disclosure primitive.
- I:HIntegrity impact, high
- The dangling work calls at91_vbus_session()/pullup(), which write MMIO through udp_baseaddr and invoke caps->pullup and possibly driver->disconnect on the freed object, enabling heap corruption and control-flow hijack.
- A:HAvailability impact, high
- Dereferencing the freed udc from timer or workqueue context causes a kernel oops or panic even without a full exploit, so availability impact is High.