CVE-2026-97483

Received Received - Intake

USB Deadlock in Linux Kernel USB Core

Publication date: 2026-09-24

Last updated on: 2026-10-03

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: usb: core: hcd: fix possible deadlock in rh control transfers >From within the SCSI error handler memory allocations must not trigger IO. Handling errors in UAS and the storage driver may involve resetting a device. The thread doing the reset itself relies on VM magic. However, that is insufficient, as resetting a device involves resuming it. Resumption as well as resetting involves conrol transfers to the parent of the device to be reset. That may be a root hub. Hence usbcore must heed the flags passed to usb_submit_urb() processing control transfers to root hubs. The problem exist since the storage driver has been merged.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-24

Last Modified

2026-10-03

Generated

2026-10-15

AI Q&A

2026-09-25

EPSS Evaluated

2026-10-13

NVD

CVE-2026-97483

EUVD

EUVD-2026-86081

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a possible deadlock in USB core hub control transfers. It occurs when the SCSI error handler triggers memory allocations that lead to IO operations, such as resetting a device. The reset process involves control transfers to the root hub, which can cause a deadlock if not handled properly.

Detection Guidance

This vulnerability involves a deadlock in USB core handling of control transfers to root hubs during SCSI error recovery. Detection requires checking for kernel logs related to USB resets or storage driver errors, particularly during device resets or error handling. Monitor dmesg or journalctl for USB-related errors or deadlock warnings.

Impact Analysis

This vulnerability could cause system hangs or crashes when USB devices are reset due to errors. It may lead to unresponsive USB hubs or devices, disrupting normal operations that rely on USB connectivity.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it involves a low-level USB subsystem issue in the Linux kernel. No evidence suggests it impacts data protection, privacy, or security controls required by these regulations.

Mitigation Strategies

Update the Linux kernel to the latest patched version to resolve the deadlock issue in USB core hcd control transfers.

Hi! I’m here to help you understand CVE-2026-97483. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70