kernel: use-after-free in usb_sg_cancel function in drivers/usb/core/message.c

A use-after-free flaw was found in usbsgcancel in drivers/usb/core/message.c in the USB core subsystem. This flaw allows a local attacker with a special user or root privileges to crash the system due to a race problem in the scatter-gather cancellation and transfer completion in usbsgwait. This...