CVE-2026-64454

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> usb: dwc3: run gadget disconnect from sleepable suspend context<br /> <br /> dwc3_gadget_suspend() takes dwc-&gt;lock with IRQs disabled and then calls<br /> dwc3_disconnect_gadget(). For async callbacks that helper only uses<br /> plain spin_unlock()/spin_lock(), so the gadget -&gt;disconnect() callback<br /> still runs with IRQs disabled and any sleepable callback trips Lockdep.<br /> <br /> This issue was found by our static analysis tool and then manually<br /> reviewed against the current tree.<br /> <br /> The grounded PoC kept the dwc3_gadget_suspend() -&gt;<br /> dwc3_disconnect_gadget() -&gt; gadget_driver-&gt;disconnect() chain, and<br /> Lockdep reported:<br /> <br /> BUG: sleeping function called from invalid context<br /> gadget_disconnect+0x21/0x39 [vuln_msv]<br /> dwc3_gadget_suspend.constprop.0+0x2b/0x42 [vuln_msv]<br /> <br /> Keep the disconnect callback selection in one common helper, but add a<br /> sleepable suspend-side wrapper which snapshots the callback under<br /> dwc-&gt;lock and then runs it after spin_unlock_irqrestore(). The regular<br /> event path still uses the existing spin_unlock()/spin_lock() window.