Executive brief
The Linux kernel's Freescale USB OTG transceiver driver contains a use-after-free vulnerability in its device removal code. When a USB device is unplugged or the driver is unloaded, a delayed work function may access memory that has already been freed, potentially causing a kernel crash or memory corruption. This affects systems with Freescale-based USB controllers.
Technical details
This is a use-after-free race condition in the Freescale USB OTG transceiver driver (drivers/usb/phy/phy-fsl-usb.c). The vulnerability occurs between the fsl_otg_remove() function and the delayed work handler fsl_otg_event(). When a device is removed, fsl_otg_remove() frees the fsl_otg_dev structure, but a pending delayed work item may still be executing or scheduled, causing the work function to dereference freed memory via container_of(). The fix calls disable_delayed_work_sync() in fsl_otg_remove() before memory deallocation to ensure the delayed work completes or is canceled before the structure is freed. Attack vectors are limited to local unplugging/unloading, and patches have been integrated into the stable kernel tree.
Affected products
- Linux Linux Kernel Multiple versions (Freescale USB OTG transceiver driver affected)
Timeline
- 2025-12-05: disclosed: Fix committed by Duoming Zhou
- 2025-12-17: patched: Patch merged into stable kernel tree
- 2026-01-02: other: CVE published
- 2026-01-13: other: Advisory published