{
  "cveId": "CVE-2026-89738",
  "url": "https://patchblox.com/security/cve/CVE-2026-89738",
  "summary": "CVE-2026-89738 is fixed in 2 products on 1 platform, first by DEBIAN-CVE-2026-89738, released September 23, 2026. It is not reported as exploited. Patch Radar priority: High.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  usb: gadget: at91_udc: drain polled-VBUS timer/w...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  usb: gadget: at91_udc: drain polled-VBUS timer/work before udc is freed  In polled-VBUS mode (board.vbus_pin \u0026\u0026 board.vbus_polled), probe arms a self-restarting cycle: at91_vbus_timer() schedules vbus_timer_work, and at91_vbus_timer_work() calls at91_vbus_update() and re-arms the timer via mod_timer(). Both recover the same udc through container_of and dereference it on every iteration.  Neither teardown path cancels this cycle. udc is devm-allocated, so it is freed after at91udc_remove() returns, and is likewise freed when probe fails and devres runs. A timer callback or work item that is pending or running at either point dereferences the freed udc.  Add at91_udc_shutdown_vbus_timer() and call it from at91udc_remove() and from the usb_add_gadget_udc() failure path in probe; the remaining probe error paths fail before the timer is armed. timer_shutdown_sync() waits for a running callback and clears timer-\u003Efunction, which makes the work handler\u0027s mod_timer() a permanent no-op; cancel_work_sync() then drains any pending or running work whose re-arm attempt now does nothing. The timer must be shut down first, since cancelling the work alone would let the timer re-queue it. The guard mirrors probe: in IRQ mode the timer and work_struct are never initialized.  This does not require a fault; a normal driver unbind can interleave with an already queued work item.  This issue was found by an in-house static analysis tool.",
  "published": "2026-09-11T20:20:04Z",
  "severity": "high",
  "cvss": 7.8,
  "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
  "epss": 0.00192,
  "epssPercentile": 0.08954,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "6.12.111-1",
      "fix": "DEBIAN-CVE-2026-89738",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-89738",
      "released": "2026-09-23T19:19:02Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "7.2.6-1",
      "fix": "DEBIAN-CVE-2026-89738",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-89738",
      "released": "2026-09-23T19:19:02Z"
    },
    {
      "platform": "linux",
      "product": "linux-6.12",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "6.12.111-1~deb12u1",
      "fix": "DEBIAN-CVE-2026-89738",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-89738",
      "released": "2026-09-23T19:19:02Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-09T07:25:28Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}