CVE-2026-98765
Received
Received - Intake
Race Condition in Linux Kernel USB Gadget Dummy-HCD Driver
Vulnerability report for CVE-2026-98765, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-10-18
Last updated on: 2026-10-18
Assigner: kernel.org
Description
Description
In the Linux kernel, the following vulnerability has been resolved:
USB: gadget: dummy-hcd: Fix wait for outstanding request completions
The dummy-hcd driver emulates synchronize_irq() by waiting until its
private callback_usage counter drops to 0 (with the private lock not
held). This counter is incremented whenever a gadget driver callback
occurs (which requires the private lock to be dropped), but not when a
request completion handler is called.
This is an oversight. Request completion is triggered by timer
interrupts (emulating device IRQs in a real UDC), and the interrupt
handlers are supposed to have completed when the synchronize_irq()
emulation routine returns -- they aren't supposed to be in the middle
of a completion callback. If this happens it can lead to a gadget
driver's unbind routine running before all outstanding request
completions have finished, maybe even allowing the gadget driver's
module to be unloaded while a completion handler is still running.
Fix the oversight by incrementing the callback_usage value across
request completion callbacks.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| Linux | Linux | 7dbd8f4cabd96db5a50513de9d83a8105a5ffc81 |
| Linux | Linux | 7dbd8f4cabd96db5a50513de9d83a8105a5ffc81 |
| Linux | Linux | 7dbd8f4cabd96db5a50513de9d83a8105a5ffc81 |
| Linux | Linux | 7dbd8f4cabd96db5a50513de9d83a8105a5ffc81 |
| Linux | Linux | 7b416b9dac6ede26d4ca0c1a88b448b543623ff3 |
| Linux | Linux | 8590bc1da625dd4a589eac0fc3aa3cf4f400424d |
| Linux | Linux | a867d5b932ac4911d3f8a1e63505061b0c81f889 |
| Linux | Linux | e84b4a008365b7edbd842a063ae28d040a98db25 |
| Linux | Linux | e39b17143a5b5aac81f066d455e5d3a9877eb3ae |
| Linux | Linux | 4f8ae1fcb0dfbb72a7678f81bf01fb7fc85c6715 |
| Linux | Linux | 3.2.97 |
| Linux | Linux | 3.16.52 |
| Linux | Linux | 4.1.46 |
| Linux | Linux | 4.4.92 |
| Linux | Linux | 4.9.55 |
| Linux | Linux | 4.13.6 |
| Linux | Linux | 4.14 |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
