CVE-2026-98762

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98762", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.368Z", "datePublished": "2026-10-18T15:47:53.656Z", "dateUpdated": "2026-10-30T12:39:31.169Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:39:31.169Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: dwc2: shut down wakeup timer before freeing HCD state\n\ndwc2_wakeup_detected() accesses the DWC2 host state and can rearm the\nwakeup timer. dwc2_hcd_free() currently deletes the timer only after\nfreeing host-owned state, and timer_delete() does not synchronize a\ncallback or prevent it from being queued again.\n\nStop and shut down the timer in dwc2_hcd_release(), before the HCD\nresources are freed. This covers both the HCD initialization error path\nand normal HCD removal."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/usb/dwc2/hcd.c"], "versions": [{"version": "7359d482eb4d3967cc8be354405ae6be6eaf732c", "lessThan": "f3d76baa5b902f681100447e9d185819c5c1316d", "status": "affected", "versionType": "git"}, {"version": "7359d482eb4d3967cc8be354405ae6be6eaf732c", "lessThan": "0b2ea59d66d046d5601ffc3e61dd09d3597c704e", "status": "affected", "versionType": "git"}, {"version": "7359d482eb4d3967cc8be354405ae6be6eaf732c", "lessThan": "82cc242da6d621752718929e6a2fa6f9554ebffe", "status": "affected", "versionType": "git"}, {"version": "7359d482eb4d3967cc8be354405ae6be6eaf732c", "lessThan": "441be312fce927443eae2821f502344d953c38bb", "status": "affected", "versionType": "git"}, {"version": "7359d482eb4d3967cc8be354405ae6be6eaf732c", "lessThan": "4333174ea52c863a50bb3e0a4726bf9f7cdf7524", "status": "affected", "versionType": "git"}, {"version": "7359d482eb4d3967cc8be354405ae6be6eaf732c", "lessThan": "79ba37dd38a321cb32a79332a3e3c68dd334dca9", "status": "affected", "versionType": "git"}, {"version": "7359d482eb4d3967cc8be354405ae6be6eaf732c", "lessThan": "fd772af9512cdecb83de34a461801533828e77fd", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/usb/dwc2/hcd.c"], "versions": [{"version": "3.10", "status": "affected"}, {"version": "0", "lessThan": "3.10", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.224", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.191", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.160", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.113", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.56", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.10", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.10", "versionEndExcluding": "5.15.224"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.10", "versionEndExcluding": "6.1.191"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.10", "versionEndExcluding": "6.6.160"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.10", "versionEndExcluding": "6.12.113"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.10", "versionEndExcluding": "6.18.56"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.10", "versionEndExcluding": "7.2.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.10", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/f3d76baa5b902f681100447e9d185819c5c1316d"}, {"url": "https://git.kernel.org/stable/c/0b2ea59d66d046d5601ffc3e61dd09d3597c704e"}, {"url": "https://git.kernel.org/stable/c/82cc242da6d621752718929e6a2fa6f9554ebffe"}, {"url": "https://git.kernel.org/stable/c/441be312fce927443eae2821f502344d953c38bb"}, {"url": "https://git.kernel.org/stable/c/4333174ea52c863a50bb3e0a4726bf9f7cdf7524"}, {"url": "https://git.kernel.org/stable/c/79ba37dd38a321cb32a79332a3e3c68dd334dca9"}, {"url": "https://git.kernel.org/stable/c/fd772af9512cdecb83de34a461801533828e77fd"}], "title": "USB: dwc2: shut down wakeup timer before freeing HCD state", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/usb/dwc2/hcd.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "f3d76baa5b902f681100447e9d185819c5c1316d", "status": "affected", "version": "7359d482eb4d3967cc8be354405ae6be6eaf732c", "versionType": "git"}, {"lessThan": "0b2ea59d66d046d5601ffc3e61dd09d3597c704e", "status": "affected", "version": "7359d482eb4d3967cc8be354405ae6be6eaf732c", "versionType": "git"}, {"lessThan": "82cc242da6d621752718929e6a2fa6f9554ebffe", "status": "affected", "version": "7359d482eb4d3967cc8be354405ae6be6eaf732c", "versionType": "git"}, {"lessThan": "441be312fce927443eae2821f502344d953c38bb", "status": "affected", "version": "7359d482eb4d3967cc8be354405ae6be6eaf732c", "versionType": "git"}, {"lessThan": "4333174ea52c863a50bb3e0a4726bf9f7cdf7524", "status": "affected", "version": "7359d482eb4d3967cc8be354405ae6be6eaf732c", "versionType": "git"}, {"lessThan": "79ba37dd38a321cb32a79332a3e3c68dd334dca9", "status": "affected", "version": "7359d482eb4d3967cc8be354405ae6be6eaf732c", "versionType": "git"}, {"lessThan": "fd772af9512cdecb83de34a461801533828e77fd", "status": "affected", "version": "7359d482eb4d3967cc8be354405ae6be6eaf732c", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/usb/dwc2/hcd.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "3.10"}, {"lessThan": "3.10", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.224", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.191", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.160", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.113", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.56", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.10", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: dwc2: shut down wakeup timer before freeing HCD state\n\ndwc2_wakeup_detected() accesses the DWC2 host state and can rearm the\nwakeup timer. dwc2_hcd_free() currently deletes the timer only after\nfreeing host-owned state, and timer_delete() does not synchronize a\ncallback or prevent it from being queued again.\n\nStop and shut down the timer in dwc2_hcd_release(), before the HCD\nresources are freed. This covers both the HCD initialization error path\nand normal HCD removal."}], "id": "CVE-2026-98762", "lastModified": "2026-10-30T13:21:25.627", "metrics": {}, "published": "2026-10-18T16:17:30.013", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/0b2ea59d66d046d5601ffc3e61dd09d3597c704e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/4333174ea52c863a50bb3e0a4726bf9f7cdf7524"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/441be312fce927443eae2821f502344d953c38bb"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/79ba37dd38a321cb32a79332a3e3c68dd334dca9"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/82cc242da6d621752718929e6a2fa6f9554ebffe"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/f3d76baa5b902f681100447e9d185819c5c1316d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/fd772af9512cdecb83de34a461801533828e77fd"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: kernel: Denial of Service via use-after-free in USB DWC2 driver", "id": "2555157", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2555157"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.7", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-416", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nUSB: dwc2: shut down wakeup timer before freeing HCD state\ndwc2_wakeup_detected() accesses the DWC2 host state and can rearm the\nwakeup timer. dwc2_hcd_free() currently deletes the timer only after\nfreeing host-owned state, and timer_delete() does not synchronize a\ncallback or prevent it from being queued again.\nStop and shut down the timer in dwc2_hcd_release(), before the HCD\nresources are freed. This covers both the HCD initialization error path\nand normal HCD removal.", "A flaw was found in the Linux kernel's USB DWC2 driver. A race condition during host controller teardown or initialization failure allows the wakeup timer to execute after host resources have been released. A local user could exploit this use-after-free vulnerability to cause a Denial of Service (DoS) by crashing the system."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2026-98762", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}], "public_date": "2026-10-18T15:47:53Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98762\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98762\nhttps://git.kernel.org/stable/c/4333174ea52c863a50bb3e0a4726bf9f7cdf7524\nhttps://git.kernel.org/stable/c/441be312fce927443eae2821f502344d953c38bb\nhttps://git.kernel.org/stable/c/79ba37dd38a321cb32a79332a3e3c68dd334dca9\nhttps://git.kernel.org/stable/c/fd772af9512cdecb83de34a461801533828e77fd\nhttps://kernelcve.org/list/?q=CVE-2026-98762"], "statement": "A teardown race exists because dwc2_wakeup_detected can access DWC2 host state and rearm the wakeup timer while dwc2_hcd_free is releasing host owned resources. The previous timer deletion did not synchronize with a running callback and did not prevent that callback from queuing the timer again. This creates a potential use after free that can cause a kernel crash and local denial of service. For the CVSS the PR:L value is used for the paranoid score because reduced capability root, a device management service, or a container with delegated driver control may be able to initiate the relevant HCD teardown without having unrestricted host root privileges. The realistic base case is PR:H because driver unbind, module removal, and normal HCD removal are generally administrator controlled. The issue is not network reachable. A connected USB device may influence wakeup activity, but the available code does not prove that an external device alone can reliably initiate HCD teardown. Impact is at least a local denial of service via kernel crash and in the worst case may allow confidentiality or integrity impact due to the potential use after free and should be reviewed manually.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[7359d482eb4d3967cc8be354405ae6be6eaf732c,441be312fce927443eae2821f502344d953c38bb)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[7359d482eb4d3967cc8be354405ae6be6eaf732c,4333174ea52c863a50bb3e0a4726bf9f7cdf7524)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[7359d482eb4d3967cc8be354405ae6be6eaf732c,79ba37dd38a321cb32a79332a3e3c68dd334dca9)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[7359d482eb4d3967cc8be354405ae6be6eaf732c,fd772af9512cdecb83de34a461801533828e77fd)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "3.10"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,3.10)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.113,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.56,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.10,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-18T22:00:20.106128+00:00", "updated": "2026-10-23T06:30:07.425857+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}