{"id":"CVE-2026-98766","kind":"vulnerability","aliases":["CVE-2026-98766"],"related":[],"title":"Linux kernel: aspeed-vhub USB gadget use-after-free on device removal","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: aspeed-vhub: cancel wake work on device removal\n\nwake_work is armed from the gadget .wakeup callback to resume suspended\ndownstream ports, and it is never cancelled in ast_vhub_remove(), so a\nwork item queued before or during removal can run after devm has freed\nvhub and its ports, a use-after-free.\n\nCancelling the work alone is not sufficient: usb_gadget_wakeup() takes\nno lock and the unbind path never clears wakeup_en, so a remote-wakeup\nrequest in flight on another CPU can re-arm the work after the cancel\nand before vhub is freed.\n\nast_vhub_del_dev() already clears d->registered under vhub->lock before\nunregistering the gadget. Refuse the wakeup in ast_vhub_udc_wakeup()\nonce d->registered is clear: the check and the schedule_work() are then\natomic against the unbind, so a wakeup that passed before the flag was\ncleared is drained by the cancel_work_sync() after the del_dev loop,\nand one that arrives later returns without arming. Also move INIT_WORK()\nto the top of ast_vhub_probe(), since the probe error path reuses\nast_vhub_remove() and would otherwise cancel a never-initialized work\nitem.\n\nThis issue was found by an in-house static analysis tool.","summary":"The Aspeed virtual USB hub driver in the Linux kernel can run a queued wake work item after the device has been removed, freeing memory that is still in use. The sources do not state what an attacker gains beyond a memory corruption crash.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["aspeed","linux-kernel","runtime","usb-gadget"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-18T16:17:30+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","triaged_at":"2026-10-25T05:16:40+00:00","updated_at":"2026-10-25T05:16:40+00:00","category":"runtime","confidence":0.4,"triage":{"at":"2026-10-25T05:16:40Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Linux kernel: aspeed-vhub USB gadget use-after-free on device removal","impact":"medium","summary":"The Aspeed virtual USB hub driver in the Linux kernel can run a queued wake work item after the device has been removed, freeing memory that is still in use. The sources do not state what an attacker gains beyond a memory corruption crash.","category":"runtime","nicknames":[],"who_cares":["linux-kernel","aspeed","usb-gadget"],"confidence":0.4,"needs_auth":"unknown","worst_case":"unknown","analyst_note":"Check the NVD entry and the upstream kernel commit for affected kernel version ranges, fixed stable versions, and whether an attacker can trigger the wakeup path remotely.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000548,"input_tokens":3682,"output_tokens":360,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':16A,19A '-98766':17A,20A 'alon':144C 'alreadi':191C 'also':257C 'analysi':297C 'anoth':171C 'arm':97C,176C,256C 'arriv':252C 'aspe':4A,21B,30B,86C 'aspeed-vhub':3A,85C 'ast':114C,187C,206C,265C,274C 'atom':223C 'attack':66B 'beyond':68B 'callback':102C 'cancel':88C,112C,141C,181C,241C,280C 'check':216C 'clear':159C,192C,214C,236C 'corrupt':71B 'cpu':172C 'crash':72B 'cve':15A,18A 'd':193C,211C 'del':189C,246C 'dev':190C,247C 'devic':13A,48B,92C 'devm':129C 'downstream':106C 'drain':238C 'driver':34B 'en':161C 'error':271C 'flag':234C 'flight':169C 'follow':78C 'found':290C 'free':11A,52B,140C 'freed':131C,186C 'gadget':7A,28B,84C,100C,149C,201C 'gain':67B 'hous':295C 'hub':33B 'in-hous':293C 'init':259C 'initi':284C 'issu':288C 'item':45B,120C,286C 'kernel':2A,24B,38B,76C 'later':253C 'linux':1A,23B,37B,75C 'linux-kernel':22B 'lock':153C,197C 'loop':248C 'memori':53B,70B 'move':258C 'never':111C,158C,283C 'never-initi':282C 'one':250C 'otherwis':279C 'pass':231C 'path':157C,272C 'port':107C,135C 'probe':267C,270C 'queu':42B,121C 're':175C 're-arm':174C 'refus':202C 'regist':194C,212C 'remot':165C 'remote-wakeup':164C 'remov':14A,51B,93C,116C,125C,276C 'request':167C 'resolv':82C 'resum':104C 'return':254C 'reus':273C 'run':40B,127C 'runtim':25B 'schedul':219C 'sinc':268C 'sourc':60B 'state':63B 'static':296C 'still':56B 'suffici':147C 'suspend':105C 'sync':243C 'take':151C 'tool':298C 'top':263C 'udc':208C 'unbind':156C,226C 'unregist':199C 'usb':6A,27B,32B,83C,148C 'usb-gadget':26B 'use':9A,58B,138C 'use-after-fre':8A,137C 'vhub':5A,87C,115C,132C,184C,188C,196C,207C,266C,275C 'virtual':31B 'vulner':79C 'wake':43B,89C,94C 'wakeup':101C,150C,160C,166C,204C,209C,229C 'without':255C 'work':44B,90C,95C,119C,143C,178C,220C,242C,260C,285C 'would':278C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:30+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98766","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98766","severity":null,"published_at":"2026-10-18T16:17:30+00:00","modified_at":"2026-10-21T13:21:44+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}