CVE-2026-98762
Received Received - Intake

USB: dwc2 Wakeup Timer Use-After-Free Vulnerability

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: USB: dwc2: shut down wakeup timer before freeing HCD state dwc2_wakeup_detected() accesses the DWC2 host state and can rearm the wakeup timer. dwc2_hcd_free() currently deletes the timer only after freeing host-owned state, and timer_delete() does not synchronize a callback or prevent it from being queued again. Stop and shut down the timer in dwc2_hcd_release(), before the HCD resources are freed. This covers both the HCD initialization error path and normal HCD removal.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-18
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-98762
EUVD
EUVD-2026-103847

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
Linux Linux 7359d482eb4d3967cc8be354405ae6be6eaf732c
Linux Linux 7359d482eb4d3967cc8be354405ae6be6eaf732c
Linux Linux 7359d482eb4d3967cc8be354405ae6be6eaf732c
Linux Linux 7359d482eb4d3967cc8be354405ae6be6eaf732c
Linux Linux 3.10

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a flaw in the dwc2 USB driver where the wakeup timer is not properly shut down before freeing the host controller state. This can lead to a use-after-free scenario where the timer callback may still attempt to access freed memory, potentially causing system instability or crashes.

Detection Guidance

This vulnerability is specific to the Linux kernel's dwc2 USB driver and requires kernel-level inspection. Detection involves checking the kernel version and driver state. Use 'uname -r' to verify kernel version and 'lsmod | grep dwc2' to confirm if the dwc2 module is loaded. If the module is loaded, examine kernel logs for related errors using 'dmesg | grep dwc2'.

Impact Analysis

If exploited, this vulnerability could cause system crashes, data corruption, or denial-of-service conditions on affected Linux systems using the dwc2 USB driver. It may also allow privilege escalation if an attacker can trigger the timer callback after memory is freed.

Mitigation Strategies

Apply the latest kernel update from your distribution to patch the dwc2 driver. If an update is unavailable, disable the dwc2 module using 'modprobe -r dwc2' and prevent it from loading at boot by adding 'blacklist dwc2' to /etc/modprobe.d/blacklist.conf. Monitor system logs for any related issues after mitigation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98762. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart