CVE-2026-89738

The Linux kernel's at91_udc USB gadget driver contains a use-after-free: in polled-VBUS mode (board.vbus_pin with board.vbus_polled), probe arms a self-restarting cycle in which at91_vbus_timer() schedules vbus_timer_work and the work handler re-arms the timer via mod_timer(), with both callbacks recovering and dereferencing the devm-allocated udc structure on every iteration — and neither the remove path nor the probe-failure path cancels this cycle. Because devres frees the udc after at91udc_remove() returns (or when a failed probe unwinds), a timer callback or work item that is pending or running at that moment dereferences freed memory, and this can occur during a completely normal driver unbind with no fault required. A local attacker with low privileges who can trigger or race the unbind could leverage the freed-memory access for kernel memory corruption, consistent with the CVSS 3.1 score of 7.8 (high impact to confidentiality, integrity, and availability — effectively local privilege escalation or a system crash). Only systems built on Atmel AT91 / Microchip SAM SoCs that use this gadget driver with a polled-VBUS board configuration are affected; the flaw was found by static analysis, no public PoC exists, and there is no evidence of exploitation in the wild. The fix adds at91_udc_shutdown_vbus_timer(), which calls timer_shutdown_sync() followed by cancel_work_sync() from at91udc_remove() and the usb_add_gadget_udc() failure path in probe, permanently preventing the work handler from re-arming the timer.

What to do: Update to a kernel containing the upstream fix (the commit adding at91_udc_shutdown_vbus_timer() in at91udc_remove() and the probe failure path) or your SoC vendor's BSP backport. Check whether your boards actually run in polled-VBUS mode — IRQ-VBUS configurations never initialize the timer/work and are unaffected. Since exploitation requires local access racing a driver unbind, restrict unprivileged local accounts and avoid unnecessary driver unbinds or module unloads on production embedded devices.