Use-After-Free Vulnerability in Linux Kernel Affects DWC3 Gadget

CVE-2026-89739

What is CVE-2026-89739?

A vulnerability in the Linux kernel's DWC3 gadget component exposes systems to a use-after-free condition due to race conditions in delayed work handling. When the gadget is removed, the cleanup sequence may lead to a scenario where memory, released for a specific endpoint, could still be accessed by queued delayed tasks, compromising system integrity. To address this vulnerability, cancelling the delayed work before memory deallocation is necessary to ensure safe memory management and operational stability.

References