---
id: CVE-2026-98766
title: 'usb: gadget: aspeed-vhub: cancel wake work on device removal'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  usb: gadget: aspeed-vhub: cancel wake work on device removal

  wake_work is armed from the gadget .wakeup callback to resume suspended
  downstream ports, and it is never …
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 7ecca2a4080cb6b1fa174adc588fce9e9014c43c <
    f343bfa3fc9f6255602d66f4a7dbe7ddef13ba41
  - >-
    Linux >= 7ecca2a4080cb6b1fa174adc588fce9e9014c43c <
    474e9e1852fb5ba0bfb26f123dd0cb361d0f4f4d
  - >-
    Linux >= 7ecca2a4080cb6b1fa174adc588fce9e9014c43c <
    c81504dfd2d93e345c98e7a012c2f2e74ce5b6a1
  - >-
    Linux >= 7ecca2a4080cb6b1fa174adc588fce9e9014c43c <
    20388c8d1d74c203fec8194c45cd31afdfab934e
  - Linux 4.18
published: '2026-10-18'
updated: '2026-10-18'
sourceUpdated: '2026-10-18T15:47:59.061Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-98766'
references:
  - url: 'https://git.kernel.org/stable/c/f343bfa3fc9f6255602d66f4a7dbe7ddef13ba41'
  - url: 'https://git.kernel.org/stable/c/474e9e1852fb5ba0bfb26f123dd0cb361d0f4f4d'
  - url: 'https://git.kernel.org/stable/c/c81504dfd2d93e345c98e7a012c2f2e74ce5b6a1'
  - url: 'https://git.kernel.org/stable/c/20388c8d1d74c203fec8194c45cd31afdfab934e'
tags:
  - cve.org
ingestedAt: '2026-10-18T16:47:32.495Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: aspeed-vhub: cancel wake work on device removal

wake_work is armed from the gadget .wakeup callback to resume suspended
downstream ports, and it is never cancelled in ast_vhub_remove(), so a
work item queued before or during removal can run after devm has freed
vhub and its ports, a use-after-free.

Cancelling the work alone is not sufficient: usb_gadget_wakeup() takes
no lock and the unbind path never clears wakeup_en, so a remote-wakeup
request in flight on another CPU can re-arm the work after the cancel
and before vhub is freed.

ast_vhub_del_dev() already clears d->registered under vhub->lock before
unregistering the gadget. Refuse the wakeup in ast_vhub_udc_wakeup()
once d->registered is clear: the check and the schedule_work() are then
atomic against the unbind, so a wakeup that passed before the flag was
cleared is drained by the cancel_work_sync() after the del_dev loop,
and one that arrives later returns without arming. Also move INIT_WORK()
to the top of ast_vhub_probe(), since the probe error path reuses
ast_vhub_remove() and would otherwise cancel a never-initialized work
item.

This issue was found by an in-house static analysis tool.

## Affected

- `Linux >= 7ecca2a4080cb6b1fa174adc588fce9e9014c43c < f343bfa3fc9f6255602d66f4a7dbe7ddef13ba41`
- `Linux >= 7ecca2a4080cb6b1fa174adc588fce9e9014c43c < 474e9e1852fb5ba0bfb26f123dd0cb361d0f4f4d`
- `Linux >= 7ecca2a4080cb6b1fa174adc588fce9e9014c43c < c81504dfd2d93e345c98e7a012c2f2e74ce5b6a1`
- `Linux >= 7ecca2a4080cb6b1fa174adc588fce9e9014c43c < 20388c8d1d74c203fec8194c45cd31afdfab934e`
- `Linux 4.18`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.