CVE-2026-98766 Linux CVE debrief

Who should care

Linux kernel developers and users, Aspeed VHub device users, and security teams responsible for vulnerability management and patching. They should review and apply the patch to cancel wake work on device removal, verify that the Linux kernel version is up-to-date, and monitor for potential exploitation attempts.

Why it matters

A use-after-free vulnerability in the Linux kernel's usb gadget driver for Aspeed VHub requires attention from Linux kernel developers and users. The vulnerability can cause system crashes or instability, and potentially allow elevation of privileges. Verification of the Linux kernel version and patching are necessary to mitigate the vulnerability.

• Potential system crashes or instability
• Possible elevation of privileges
• Required verification of Linux kernel version
• Potential security risks if not patched

Technical summary

The Linux kernel's usb gadget driver for Aspeed VHub has a use-after-free vulnerability. When a device is removed, the wake work is not cancelled, allowing a work item to run after the device has been freed. This can cause a use-after-free error. The vulnerability was caused by a missing cancel of the wake work in the ast_vhub_remove() function. The wake work is armed from the gadget .wakeup callback to resume suspended downstream ports. The issue can cause system crashes or instability, and potentially allow elevation of privileges.

Defensive priority

Medium

Recommended defensive actions

• Review and apply the patch to cancel wake work on device removal
• Verify that the Linux kernel version is up-to-date
• Monitor for potential exploitation attempts
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified

Evidence notes

The vulnerability was found by an in-house static analysis tool. The CVE record and NVD entry provide details on the vulnerability, but there is limited information on exploitation or impact. The tool analyzed the Linux kernel code and identified the use-after-free vulnerability in the usb gadget driver for Aspeed VHub. The analysis revealed that the wake work was not cancelled when a device was removed, leading to a potential use-after-free error.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.