CVE-2026-89739: Linux Kernel DWC3 Use-After-Free Vulnerability

CVE-2026-89739 Overview

CVE-2026-89739 is a use-after-free vulnerability in the Linux kernel's USB DesignWare Controller 3 (DWC3) gadget driver. The flaw exists in dwc3_gadget_free_endpoints and stems from a race condition between endpoint teardown and a pending delayed work item (dwc3_nostream_work). When the gadget is removed while a DEPEVT_STREAM_NOSTREAM event is queued on system_percpu_wq, the delayed work can execute against a dep structure that has already been freed by kfree(dep).

Critical Impact
A race between USB gadget teardown and pending stream-event work can cause the kernel to dereference a freed endpoint structure, leading to memory corruption or kernel panic.

Affected Products

Linux kernel USB DWC3 gadget driver (drivers/usb/dwc3/gadget.c)
Systems using DesignWare USB3 controllers in gadget mode
Kernel versions containing dwc3_gadget_endpoint_stream_event prior to the fixing commits

Discovery Timeline

2026-09-11 - CVE-2026-89739 published to NVD
2026-09-11 - Last updated in NVD database

Technical Details for CVE-2026-89739

Vulnerability Analysis

The DWC3 gadget driver initializes each endpoint in dwc3_gadget_init_endpoint and binds &dep->nostream_work to the dwc3_nostream_work handler. When the controller receives a DEPEVT_STREAM_NOSTREAM event, dwc3_gadget_endpoint_stream_event queues this delayed work on system_percpu_wq. The endpoint descriptor dep is allocated with kzalloc() at initialization.

During gadget removal, dwc3_gadget_free_endpoints performs cleanup by calling dwc3_free_trb_pool(dep), removing the endpoint from its list, tearing down the debugfs directory, and finally releasing memory via kfree(dep). The teardown path does not cancel the delayed work before freeing dep. If dwc3_nostream_work is still pending or running on another CPU, it dereferences the freed structure.

Root Cause

The root cause is missing synchronization between the workqueue lifecycle and the endpoint memory lifecycle. dwc3_gadget_free_endpoints releases dep without calling cancel_delayed_work_sync() on dep->nostream_work, leaving the worker with a dangling pointer. This is a classic Use-After-Free [CWE-416] driven by a Race Condition [CWE-362].

Attack Vector

Triggering the race requires local conditions that cause the DWC3 controller to receive a DEPEVT_STREAM_NOSTREAM event concurrent with gadget teardown, for example by unbinding or unloading the gadget driver while USB stream traffic is active. Successful exploitation produces kernel memory corruption, which can manifest as denial of service through a kernel panic or, under favorable heap conditions, escalate to unauthorized kernel memory manipulation.

The vulnerability manifests during the following interleaving: CPU1 executes dwc3_thread_interrupt → dwc3_endpoint_interrupt → dwc3_gadget_endpoint_stream_event, queuing nostream_work; CPU0 concurrently runs dwc3_gadget_free_endpoints and calls kfree(dep); CPU1 then dispatches dwc3_nostream_work, which uses the freed dep. See the upstream fixing commits for the exact patch: 448e95c0f3ea, 93e08b13a7a3, and 9c855832790c.

Detection Methods for CVE-2026-89739

Indicators of Compromise

Kernel oops or panic stack traces referencing dwc3_nostream_work, dwc3_gadget_free_endpoints, or dwc3_gadget_endpoint_stream_event.
KASAN reports flagging use-after-free reads or writes against DWC3 endpoint (dep) allocations.
Unexpected reboots correlated with USB gadget driver unbind or module unload events.

Detection Strategies

Enable CONFIG_KASAN and CONFIG_DEBUG_KMEMLEAK on test kernels to surface the race deterministically during QA.
Audit running kernel versions across the fleet against the fixed stable commits to identify unpatched hosts.
Correlate USB subsystem messages in dmesg and journalctl -k with workqueue-related crash signatures.

Monitoring Recommendations

Ingest kernel logs and crash dumps into a centralized data lake to identify recurring DWC3 stack traces across hosts.
Alert on abnormal frequency of USB gadget bind/unbind cycles on devices that use DWC3 in gadget mode.
Track kernel package versions through configuration management to confirm patch coverage on all affected systems.

How to Mitigate CVE-2026-89739

Immediate Actions Required

Apply the upstream fix that calls cancel_delayed_work_sync(&dep->nostream_work) before kfree(dep) in dwc3_gadget_free_endpoints.
Update to a stable kernel release that includes commits 448e95c0f3ea, 93e08b13a7a3, or 9c855832790c.
Prioritize patching on embedded and mobile platforms that use DesignWare USB3 controllers in peripheral mode.

Patch Information

The fix cancels the pending delayed work before releasing the endpoint structure. Reference the stable tree commits 448e95c0f3ea, 93e08b13a7a3, and 9c855832790c. Distribution maintainers ship the patch in their next stable kernel update; consume vendor-supplied kernels where possible.

Workarounds

Avoid runtime unbind or module removal of the DWC3 gadget driver while USB stream endpoints are active.
Restrict local access to /sys/bus/platform/drivers/dwc3 and gadget configuration paths so unprivileged users cannot trigger the teardown path.
Where the DWC3 gadget function is not required, disable the driver in the kernel configuration to eliminate the code path entirely.

bash

# Verify installed kernel version and confirm patch presence
uname -r
git log --oneline drivers/usb/dwc3/gadget.c | grep -Ei 'nostream_work|use-after-free'

# Optional: prevent automatic loading of the DWC3 gadget module where not required
echo 'blacklist dwc3' | sudo tee /etc/modprobe.d/dwc3-blacklist.conf
sudo update-initramfs -u