Answer in brief
CVE-2026-89738 records a High severity (CVSS 7.8) vulnerability in usb: gadget: at91_udc: drain polled-VBUS timer/work before udc is freed. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.8. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=4037242c4f5ff77afe61bf07ca1e8a99490219e5 <a2a602cb1e28d76a5398cec3fa21b0110385f501 || >=4037242c4f5ff77afe61bf07ca1e8a99490219e5 <51a311eb97e91ce1aed3005cb71ccb2e30f8cce8 || >=4037242c4f5ff77afe61bf07ca1e8a99490219e5 <557ef547d49ff5e6026a4d39bdd3113bd81d7688 || >=4037242c4f5ff77afe61bf07ca1e8a99490219e5 <c27d13ce4bab80fbdf6523928071b6c24b37606c | a2a602cb1e28d76a5398cec3fa21b0110385f501, 51a311eb97e91ce1aed3005cb71ccb2e30f8cce8, 557ef547d49ff5e6026a4d39bdd3113bd81d7688, c27d13ce4bab80fbdf6523928071b6c24b37606c |
| Linux/Linuxgeneric | 2.6.36 | Not reported |
| Linux/Linuxgeneric | >=4037242c4f5ff77afe61bf07ca1e8a99490219e5 <723d73b245843d4fff4c3f42e857c78c2b2d414e || >=4037242c4f5ff77afe61bf07ca1e8a99490219e5 <a2a602cb1e28d76a5398cec3fa21b0110385f501 || >=4037242c4f5ff77afe61bf07ca1e8a99490219e5 <51a311eb97e91ce1aed3005cb71ccb2e30f8cce8 || >=4037242c4f5ff77afe61bf07ca1e8a99490219e5 <557ef547d49ff5e6026a4d39bdd3113bd81d7688 || >=4037242c4f5ff77afe61bf07ca1e8a99490219e5 <c27d13ce4bab80fbdf6523928071b6c24b37606c | 723d73b245843d4fff4c3f42e857c78c2b2d414e, a2a602cb1e28d76a5398cec3fa21b0110385f501, 51a311eb97e91ce1aed3005cb71ccb2e30f8cce8, 557ef547d49ff5e6026a4d39bdd3113bd81d7688, c27d13ce4bab80fbdf6523928071b6c24b37606c |
Published upstream
Sep 11, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 21, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Sep 11, 2026
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: at91_udc: drain polled-VBUS timer/work before udc is freed In polled-VBUS mode (board.vbus_pin && board.vbus_polled), probe arms a self-restarting cycle: at91_vbus_timer() schedules vbus_timer_work, and at91_vbus_timer_work() calls at91_vbus_update() and re-arms the timer via mod_timer(). Both recover the same udc through container_of and dereference it on every iteration. Neither teardown path cancels this cycle. udc is devm-allocated, so it is freed after at91udc_remove() returns, and is likewise freed when probe fails and devres runs. A timer callback or work item that is pending or running at either point dereferences the freed udc. Add at91_udc_shutdown_vbus_timer() and call it from at91udc_remove() and from the usb_add_gadget_udc() failure path in probe; the remaining probe error paths fail before the timer is armed. timer_shutdown_sync() waits for a running callback and clears timer->function, which makes the work handler's mod_timer() a permanent no-op; cancel_work_sync() then drains any pending or running work whose re-arm attempt now does nothing. The timer must be shut down first, since cancelling the work alone would let the timer re-queue it. The guard mirrors probe: in IRQ mode the timer and work_struct are never initialized. This does not require a fault; a normal driver unbind can interleave with an already queued work item. This issue was found by an in-house static analysis tool.
Quoted source text, attributed separately from HOL analysis.