CVE-2026-98696

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98696", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.365Z", "datePublished": "2026-10-18T15:46:20.399Z", "dateUpdated": "2026-10-30T12:38:48.486Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:38:48.486Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: serial: fix driver deregistration order\n\nUSB serial driver modules register one driver for the USB bus and one or\nmore drivers for the ports on the USB serial bus.\n\nWhen unloading a driver module, the USB driver must be deregistered\nbefore the USB serial bus drivers so that I/O is stopped before\nunbinding the ports to avoid use-after-free in completion handlers\naccessing port data.\n\nNote that the \"new_id\" attributes must first be removed to prevent new\nids from being added and triggering a probe of the USB driver after it\nhas been deregistered."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/usb/serial/bus.c", "drivers/usb/serial/usb-serial.c", "include/linux/usb/serial.h"], "versions": [{"version": "765e0ba62613fb90f09c1b5926750df0aa56f349", "lessThan": "991904982827f07706c643bb0428c4b689b254e3", "status": "affected", "versionType": "git"}, {"version": "765e0ba62613fb90f09c1b5926750df0aa56f349", "lessThan": "7c65438e3b98bd6009af09db8c725547192cdfe0", "status": "affected", "versionType": "git"}, {"version": "765e0ba62613fb90f09c1b5926750df0aa56f349", "lessThan": "2f12343f39e316ff66adc84a6db3569f33b50f66", "status": "affected", "versionType": "git"}, {"version": "765e0ba62613fb90f09c1b5926750df0aa56f349", "lessThan": "e7ad832b1144df19cbbaaa655625c6f984e85b9f", "status": "affected", "versionType": "git"}, {"version": "765e0ba62613fb90f09c1b5926750df0aa56f349", "lessThan": "9b085a06a0a411b0bcdf18b61c3ebf1be1c72ffe", "status": "affected", "versionType": "git"}, {"version": "765e0ba62613fb90f09c1b5926750df0aa56f349", "lessThan": "a1aa474768f69ea3a70da523f00f74c264cfa10e", "status": "affected", "versionType": "git"}, {"version": "765e0ba62613fb90f09c1b5926750df0aa56f349", "lessThan": "428d479a0d31460fbf5969ab262ccd673f1fac01", "status": "affected", "versionType": "git"}, {"version": "765e0ba62613fb90f09c1b5926750df0aa56f349", "lessThan": "646e5b28b4fdbc1b828a2398d6ced2c1dd308a46", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/usb/serial/bus.c", "drivers/usb/serial/usb-serial.c", "include/linux/usb/serial.h"], "versions": [{"version": "3.4", "status": "affected"}, {"version": "0", "lessThan": "3.4", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.273", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.224", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.191", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.160", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.113", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.56", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.10", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.4", "versionEndExcluding": "5.10.273"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.4", "versionEndExcluding": "5.15.224"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.4", "versionEndExcluding": "6.1.191"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.4", "versionEndExcluding": "6.6.160"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.4", "versionEndExcluding": "6.12.113"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.4", "versionEndExcluding": "6.18.56"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.4", "versionEndExcluding": "7.2.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.4", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/991904982827f07706c643bb0428c4b689b254e3"}, {"url": "https://git.kernel.org/stable/c/7c65438e3b98bd6009af09db8c725547192cdfe0"}, {"url": "https://git.kernel.org/stable/c/2f12343f39e316ff66adc84a6db3569f33b50f66"}, {"url": "https://git.kernel.org/stable/c/e7ad832b1144df19cbbaaa655625c6f984e85b9f"}, {"url": "https://git.kernel.org/stable/c/9b085a06a0a411b0bcdf18b61c3ebf1be1c72ffe"}, {"url": "https://git.kernel.org/stable/c/a1aa474768f69ea3a70da523f00f74c264cfa10e"}, {"url": "https://git.kernel.org/stable/c/428d479a0d31460fbf5969ab262ccd673f1fac01"}, {"url": "https://git.kernel.org/stable/c/646e5b28b4fdbc1b828a2398d6ced2c1dd308a46"}], "title": "USB: serial: fix driver deregistration order", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/usb/serial/bus.c", "drivers/usb/serial/usb-serial.c", "include/linux/usb/serial.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "991904982827f07706c643bb0428c4b689b254e3", "status": "affected", "version": "765e0ba62613fb90f09c1b5926750df0aa56f349", "versionType": "git"}, {"lessThan": "7c65438e3b98bd6009af09db8c725547192cdfe0", "status": "affected", "version": "765e0ba62613fb90f09c1b5926750df0aa56f349", "versionType": "git"}, {"lessThan": "2f12343f39e316ff66adc84a6db3569f33b50f66", "status": "affected", "version": "765e0ba62613fb90f09c1b5926750df0aa56f349", "versionType": "git"}, {"lessThan": "e7ad832b1144df19cbbaaa655625c6f984e85b9f", "status": "affected", "version": "765e0ba62613fb90f09c1b5926750df0aa56f349", "versionType": "git"}, {"lessThan": "9b085a06a0a411b0bcdf18b61c3ebf1be1c72ffe", "status": "affected", "version": "765e0ba62613fb90f09c1b5926750df0aa56f349", "versionType": "git"}, {"lessThan": "a1aa474768f69ea3a70da523f00f74c264cfa10e", "status": "affected", "version": "765e0ba62613fb90f09c1b5926750df0aa56f349", "versionType": "git"}, {"lessThan": "428d479a0d31460fbf5969ab262ccd673f1fac01", "status": "affected", "version": "765e0ba62613fb90f09c1b5926750df0aa56f349", "versionType": "git"}, {"lessThan": "646e5b28b4fdbc1b828a2398d6ced2c1dd308a46", "status": "affected", "version": "765e0ba62613fb90f09c1b5926750df0aa56f349", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/usb/serial/bus.c", "drivers/usb/serial/usb-serial.c", "include/linux/usb/serial.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "3.4"}, {"lessThan": "3.4", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.273", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.224", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.191", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.160", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.113", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.56", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.10", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: serial: fix driver deregistration order\n\nUSB serial driver modules register one driver for the USB bus and one or\nmore drivers for the ports on the USB serial bus.\n\nWhen unloading a driver module, the USB driver must be deregistered\nbefore the USB serial bus drivers so that I/O is stopped before\nunbinding the ports to avoid use-after-free in completion handlers\naccessing port data.\n\nNote that the \"new_id\" attributes must first be removed to prevent new\nids from being added and triggering a probe of the USB driver after it\nhas been deregistered."}], "id": "CVE-2026-98696", "lastModified": "2026-10-30T13:21:18.720", "metrics": {}, "published": "2026-10-18T16:17:23.070", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/2f12343f39e316ff66adc84a6db3569f33b50f66"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/428d479a0d31460fbf5969ab262ccd673f1fac01"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/646e5b28b4fdbc1b828a2398d6ced2c1dd308a46"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/7c65438e3b98bd6009af09db8c725547192cdfe0"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/991904982827f07706c643bb0428c4b689b254e3"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/9b085a06a0a411b0bcdf18b61c3ebf1be1c72ffe"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a1aa474768f69ea3a70da523f00f74c264cfa10e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e7ad832b1144df19cbbaaa655625c6f984e85b9f"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: kernel: Denial of Service via use-after-free in USB serial driver deregistration", "id": "2555170", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2555170"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.1", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-416", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nUSB: serial: fix driver deregistration order\nUSB serial driver modules register one driver for the USB bus and one or\nmore drivers for the ports on the USB serial bus.\nWhen unloading a driver module, the USB driver must be deregistered\nbefore the USB serial bus drivers so that I/O is stopped before\nunbinding the ports to avoid use-after-free in completion handlers\naccessing port data.\nNote that the \"new_id\" attributes must first be removed to prevent new\nids from being added and triggering a probe of the USB driver after it\nhas been deregistered.", "A flaw was found in the Linux kernel's USB serial subsystem. A local user with administrative privileges could exploit this flaw to cause a Denial of Service (DoS) or memory corruption. During the unloading of a USB serial driver module, drivers are deregistered in an incorrect sequence, allowing completion handlers to access port data after it has been released, triggering a use-after-free condition."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2026-98696", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}], "public_date": "2026-10-18T15:46:20Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98696\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98696\nhttps://git.kernel.org/stable/c/428d479a0d31460fbf5969ab262ccd673f1fac01\nhttps://git.kernel.org/stable/c/646e5b28b4fdbc1b828a2398d6ced2c1dd308a46\nhttps://git.kernel.org/stable/c/9b085a06a0a411b0bcdf18b61c3ebf1be1c72ffe\nhttps://git.kernel.org/stable/c/a1aa474768f69ea3a70da523f00f74c264cfa10e\nhttps://kernelcve.org/list/?q=CVE-2026-98696"], "statement": "An incorrect USB serial driver deregistration order can leave USB I/O active while serial port drivers are being unbound and their port data is released. A completion handler may then access freed port data, creating a race based use after free that can cause a kernel crash and may potentially affect confidentiality or integrity if the stale object access becomes controllable. For the CVSS the PR:H is selected because reliable triggering normally requires unloading or deregistering the kernel module through root or CAP_SYS_MODULE. AC:H reflects the timing window between an outstanding USB completion and port teardown. The issue is not network reachable. A connected USB device or a local process using the serial port may influence I/O timing, but neither normally controls module removal without additional privileges. Impact is at least a local denial of service via kernel crash and in the worst defensible case may include confidentiality or integrity impact due to the documented use after free.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[765e0ba62613fb90f09c1b5926750df0aa56f349,9b085a06a0a411b0bcdf18b61c3ebf1be1c72ffe)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[765e0ba62613fb90f09c1b5926750df0aa56f349,a1aa474768f69ea3a70da523f00f74c264cfa10e)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[765e0ba62613fb90f09c1b5926750df0aa56f349,428d479a0d31460fbf5969ab262ccd673f1fac01)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[765e0ba62613fb90f09c1b5926750df0aa56f349,646e5b28b4fdbc1b828a2398d6ced2c1dd308a46)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "3.4"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,3.4)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.113,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.56,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.10,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3-rc6,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-18T20:00:12.043495+00:00", "updated": "2026-10-22T21:15:12.497982+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}