CVE-2026-98767
Received
Received - Intake
IRQ Storm in Linux Kernel USB DWC3 Gadget
Vulnerability report for CVE-2026-98767, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-10-18
Last updated on: 2026-10-18
Assigner: kernel.org
Description
Description
In the Linux kernel, the following vulnerability has been resolved:
usb: dwc3: gadget: fix IRQ storm on invalid event buffer count
When dwc3_check_event_buf() reads a GEVNTCOUNT value exceeding the
event buffer length, commit 63ccd26cd1f6 ("usb: dwc3: gadget: check
that event count does not exceed event buffer length") returns IRQ_NONE
without writing back GEVNTCOUNT. Since the DWC3 interrupt is
level-triggered, the uncleared IRQ source keeps the line asserted,
causing a tight IRQ storm that accumulates 99,900 unhandled interrupts
and triggers spurious.c:184 BUG -> kernel panic.
The resulting call stack:
__report_bad_irq+0xac/0xc8
note_interrupt+0x340/0x468
handle_irq_event+0xac/0xc0
handle_fasteoi_irq+0x120/0x228
gic_handle_irq+0x68/0x108
...
kernel BUG at kernel/irq/spurious.c:184
To reproduce, write a bogus value exceeding the event buffer length
directly to the GEVNTCOUNT register:
devmem <DWC3_BASE + 0xc40c> 4 0x1004
Write the bogus count back to GEVNTCOUNT to clear the IRQ source,
consistent with the stale event clearing pattern in
dwc3_event_buffers_setup(), and schedule error recovery to
reinitialize the controller.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| Linux | Linux | 52a7c9d930b95aa8b1620edaba4818040c32631f |
| Linux | Linux | 63ccd26cd1f6600421795f6ca3e625076be06c9f |
| Linux | Linux | 63ccd26cd1f6600421795f6ca3e625076be06c9f |
| Linux | Linux | 63ccd26cd1f6600421795f6ca3e625076be06c9f |
| Linux | Linux | 015c39f38e69a491d2abd5e98869a500a9459b3b |
| Linux | Linux | b43225948b231b3f331194010f84512bee4d9f59 |
| Linux | Linux | c0079630f268843a25ed75226169cba40e0d8880 |
| Linux | Linux | a44547015287a19001384fe94dbff84c92ce4ee1 |
| Linux | Linux | c4d80e41cb42008dceb35e5dbf52574d93beac0d |
| Linux | Linux | 99d655119b870ee60e4dbf310aa9a1ed8d9ede3d |
| Linux | Linux | 6.12.26 |
| Linux | Linux | 5.4.293 |
| Linux | Linux | 5.10.237 |
| Linux | Linux | 5.15.181 |
| Linux | Linux | 6.1.136 |
| Linux | Linux | 6.6.89 |
| Linux | Linux | 6.14.5 |
| Linux | Linux | 6.15 |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
