CVE-2026-98763

Received Received - Intake

USB Control Endpoint Use-After-Free in Linux Kernel

Publication date: 2026-10-18

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: usb: core: clear both ep_in and ep_out for non-ep0 control endpoints In usb_enable_endpoint(), non-zero control endpoints (where usb_endpoint_xfer_control(&ep->desc) is true) populate both dev->ep_in[epnum] and dev->ep_out[epnum] with the same struct usb_host_endpoint pointer. However, usb_disable_endpoint() only clears either dev->ep_out[epnum] or dev->ep_in[epnum] depending on the direction bit of epaddr when reset_hardware is set, leaving the opposite direction's array slot pointing to the disabled/freed endpoint. Clear both dev->ep_out[epnum] and dev->ep_in[epnum] when disabling a non-ep0 control endpoint with reset_hardware set, and update the function kerneldoc accordingly. Tested in QEMU against Linux 7.3.0-rc3 using dummy_hcd and raw-gadget to enumerate a USB device with a non-zero control endpoint (bEndpointAddress 0x01, bmAttributes USB_ENDPOINT_XFER_CONTROL), verifying that both dev->ep_in[1] and dev->ep_out[1] are cleared when the interface is disabled.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-18

Last Modified

2026-10-19

Generated

2026-10-19

AI Q&A

2026-10-18

EPSS Evaluated

N/A

NVD

CVE-2026-98763

EUVD

EUVD-2026-103848

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Linux	Linux	1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Linux	Linux	1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Linux	Linux	1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Linux	Linux	2.6.12

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves improper handling of USB control endpoints. When disabling a non-zero control endpoint, the kernel fails to clear both input and output endpoint pointers, leaving one pointing to a disabled or freed endpoint. This could lead to use-after-free issues or other memory corruption problems.

Detection Guidance

This vulnerability is specific to the Linux kernel's USB core subsystem and requires kernel-level inspection. Detection involves checking for improper handling of non-zero control endpoints in the kernel code. No direct network or system commands can detect this; instead, review kernel logs for USB-related errors or inspect the kernel source code for the described issue in usb_enable_endpoint() and usb_disable_endpoint().

Impact Analysis

If exploited, this flaw could allow an attacker to cause system crashes, execute arbitrary code, or escalate privileges on a vulnerable system. It primarily affects systems using USB devices with non-zero control endpoints.

Compliance Impact

This vulnerability affects USB endpoint handling in the Linux kernel and does not directly impact compliance with standards like GDPR or HIPAA. It involves memory management in USB device drivers, which is unrelated to data protection or privacy regulations.

Mitigation Strategies

Update the Linux kernel to a patched version that resolves this issue. Monitor vendor advisories for kernel updates addressing the usb core endpoint handling flaw.

Hi! I’m here to help you understand CVE-2026-98763. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70