CVE-2026-89738: Linux Kernel USB Gadget Use-After-Free

CVE-2026-89738 Overview

CVE-2026-89738 is a use-after-free vulnerability in the Linux kernel's at91_udc USB gadget driver. The flaw resides in polled-VBUS mode, where the driver arms a self-restarting timer and workqueue cycle through at91_vbus_timer() and at91_vbus_timer_work(). Neither teardown path cancels this cycle before the devm-allocated udc structure is freed. A timer callback or work item pending during driver unbind or probe failure dereferences freed memory. The issue was identified by an in-house static analysis tool and resolved by adding at91_udc_shutdown_vbus_timer() to drain the timer and work before teardown completes.

Critical Impact
A local attacker with the ability to trigger driver unbind on affected AT91 SoC hardware can trigger memory corruption in kernel space, leading to privilege escalation or denial of service.

Affected Products

Linux kernel usb/gadget/at91_udc driver in polled-VBUS mode
AT91 SoC-based boards configured with board.vbus_pin and board.vbus_polled
Multiple stable kernel branches (per upstream commits 51a311e, 557ef54, a2a602c, c27d13c)

Discovery Timeline

2026-09-11 - CVE-2026-89738 published to NVD
2026-09-13 - Last updated in NVD database

Technical Details for CVE-2026-89738

Vulnerability Analysis

The at91_udc driver operates in two modes for VBUS detection: interrupt-driven and polled. When the board configuration enables both board.vbus_pin and board.vbus_polled, the probe path arms a self-restarting cycle. The function at91_vbus_timer() schedules vbus_timer_work, and at91_vbus_timer_work() calls at91_vbus_update() before re-arming the timer through mod_timer(). Both callbacks recover the udc structure through container_of and dereference it on every iteration.

The udc structure is allocated with the device-managed (devm) API. Devres frees the allocation when at91udc_remove() returns or when probe fails and devres unwinds. Neither path cancels the timer or workqueue, so a pending or running callback continues to access freed memory. Normal driver unbind is sufficient to trigger the race; no fault injection is required.

Root Cause

The root cause is missing teardown of a self-restarting timer and workqueue pair before the backing udc structure is freed. Cancelling the work alone would allow the timer to re-queue it, so the timer must be shut down first. The fix introduces at91_udc_shutdown_vbus_timer(), which calls timer_shutdown_sync() followed by cancel_work_sync(). timer_shutdown_sync() waits for any running callback, then clears timer->function, converting subsequent mod_timer() calls from the work handler into no-ops. cancel_work_sync() then drains any pending or running work.

Attack Vector

Exploitation requires local access with the ability to trigger driver unbind on hardware exposing the AT91 UDC in polled-VBUS mode. An attacker unbinds the driver at a moment when the polling timer or work item is pending or executing. The freed udc structure is then dereferenced by the residual callback. Depending on heap state and allocator behavior, this produces kernel memory corruption, information disclosure, or a crash. The fix is captured in the upstream commits 51a311e, 557ef54, a2a602c, and c27d13c.

Detection Methods for CVE-2026-89738

Indicators of Compromise

Kernel oops or panic referencing at91_vbus_timer, at91_vbus_timer_work, or at91_vbus_update in the call trace
KASAN use-after-free reports pointing to the at91_udc driver during device unbind
Unexpected reboots or kernel log corruption on AT91 SoC boards following USB gadget driver operations

Detection Strategies

Enable KASAN on test kernels for AT91 platforms and exercise driver bind and unbind cycles to surface the use-after-free
Audit running kernel versions against the fixed commits listed in the upstream references
Correlate dmesg output with configuration-management inventory to identify hosts running at91_udc in polled-VBUS mode

Monitoring Recommendations

Forward kernel logs to a centralized log store and alert on oops or KASAN signatures referencing at91_udc
Track sysfs driver bind and unbind events on embedded devices using AT91 hardware
Monitor for repeated driver reload patterns that could indicate exploitation attempts on affected boards

How to Mitigate CVE-2026-89738

Immediate Actions Required

Apply the patched Linux kernel from the stable trees referenced in the upstream commits
Identify AT91 SoC deployments with board.vbus_pin and board.vbus_polled configured and prioritize them for update
Restrict local access on affected embedded systems until patches are applied

Patch Information

The fix adds at91_udc_shutdown_vbus_timer() and invokes it from at91udc_remove() and from the usb_add_gadget_udc() failure path in probe. The remaining probe error paths fail before the timer is armed, so no additional guard is required. In IRQ mode, the timer and work_struct are never initialized, and the shutdown routine mirrors probe by skipping teardown when polling is disabled. The patched code is available in stable commits 51a311e, 557ef54, a2a602c, and c27d13c.

Workarounds

Where feasible, configure affected boards to use IRQ-driven VBUS detection instead of polled mode, since the timer and work path are never initialized in IRQ mode
Restrict CAP_SYS_MODULE and driver unbind privileges through sysfs permission hardening to reduce the local attack surface
Rebuild kernels with CONFIG_USB_AT91 disabled on systems that do not require the AT91 UDC driver

bash

# Verify kernel version and check for the fix
uname -r
git log --oneline drivers/usb/gadget/udc/at91_udc.c | grep -E '51a311e|557ef54|a2a602c|c27d13c'

# Restrict driver unbind access on affected hosts
chmod 600 /sys/bus/platform/drivers/at91_udc/unbind