CVE-2026-98696
Received Received - Intake

USB Serial Driver Deregistration Order Fix

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: USB: serial: fix driver deregistration order USB serial driver modules register one driver for the USB bus and one or more drivers for the ports on the USB serial bus. When unloading a driver module, the USB driver must be deregistered before the USB serial bus drivers so that I/O is stopped before unbinding the ports to avoid use-after-free in completion handlers accessing port data. Note that the "new_id" attributes must first be removed to prevent new ids from being added and triggering a probe of the USB driver after it has been deregistered.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-18
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-98696
EUVD
EUVD-2026-103950

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
Linux Linux 765e0ba62613fb90f09c1b5926750df0aa56f349
Linux Linux 765e0ba62613fb90f09c1b5926750df0aa56f349
Linux Linux 765e0ba62613fb90f09c1b5926750df0aa56f349
Linux Linux 765e0ba62613fb90f09c1b5926750df0aa56f349
Linux Linux 3.4

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves incorrect deregistration order of USB serial driver modules. When unloading a driver, the USB driver must be deregistered before the USB serial bus drivers to prevent use-after-free issues in completion handlers accessing port data.

Detection Guidance

This vulnerability is specific to the Linux kernel's USB serial driver deregistration order. Detection requires checking kernel logs for use-after-free errors or crashes during USB serial driver unloading. Monitor logs with 'dmesg | grep -i usb' or 'journalctl -k | grep -i usb' after unloading a USB serial driver module.

Impact Analysis

This vulnerability could lead to system crashes or memory corruption if a USB serial driver is improperly unloaded. It may cause use-after-free errors, potentially allowing attackers to execute arbitrary code or cause denial-of-service conditions.

Mitigation Strategies

Apply the latest Linux kernel updates to ensure the fix is included. Avoid unloading USB serial driver modules until the update is applied. If unloading is necessary, ensure no active I/O is occurring on the USB serial devices.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98696. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart