CVE-2026-98766 usb: gadget: aspeed-vhub: cancel wake work on device removal
A use-after-free in the Linux kernel's Aspeed virtual hub driver allows attackers with physical or local access to execute code or crash the system via USB gadget removal.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-98766?
CVE-2026-98766 is an use after free vulnerability in Linux, published on 18 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: aspeed-vhub: cancel wake work on device removal
wake_work is armed from the gadget .wakeup callback to resume suspended downstream ports, and it is never cancelled in ast_vhub_remove(), so a work item queued before or during removal can run after devm has freed vhub and its ports, a use-after-free.
Cancelling the work alone is not sufficient: usb_gadget_wakeup() takes no lock and the unbind path never clears wakeup_en, so a remote-wakeup request in flight on another CPU can re-arm the work after the cancel and before vhub is freed.
ast_vhub_del_dev() already clears d->registered under vhub->lock before unregistering the gadget. Refuse the wakeup in ast_vhub_udc_wakeup() once d->registered is clear: the check and the schedule_work() are then atomic against the unbind, so a wakeup that passed before the flag was cleared is drained by the cancel_work_sync() after the del_dev loop, and one that arrives later returns without arming. Also move INIT_WORK() to the top of ast_vhub_probe(), since the probe error path reuses ast_vhub_remove() and would otherwise cancel a never-initialized work item.
This issue was found by an in-house static analysis tool.
Which versions are affected by CVE-2026-98766?
How do I fix CVE-2026-98766?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-98766 being exploited?
There is no known exploitation of CVE-2026-98766 in the wild and no public exploit code.
Sources
Also known as AZL-109023, BELL-CVE-2026-98766, DEBIAN-CVE-2026-98766, GHSA-5m27-6x28-p9v6, UBUNTU-CVE-2026-98766.