CVE-2026-98773
Received Received - Intake

USB: cdc-acm Use-After-Free in Port Shutdown

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: USB: cdc-acm: skip URB restart in port_shutdown if disconnected acm_port_shutdown() is called from the tty-port machinery whenever the last user closes the port. acm_disconnect() sets acm->disconnected and calls tty_port_tty_vhangup(), which eventually triggers port_shutdown(). At that point acm_disconnect() has already called acm_poison_urbs() and is about to free the control and read URBs. However, acm_port_shutdown() unconditionally calls acm_unpoison_urbs() and, when the ALWAYS_POLL_CTRL quirk is set, immediately re-submits the ctrlurb and all read URBs. If the concurrent acm_disconnect() then frees those URBs and their DMA buffers while they are in-flight, the result is a use-after-free in acm_ctrl_irq() or acm_read_bulk_callback() accessing the freed DMA memory. Fix by checking acm->disconnected after draining the delayed anchor and returning early: if we are in a disconnect path the URBs must remain poisoned and must not be resubmitted. The early return is placed after the delayed-anchor drain loop because that loop only cancels write-side accounting (wb->use = false and autopm counter) and does not touch the hardware path.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-18
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-98773
EUVD
EUVD-2026-103858

Affected Vendors & Products

Showing 15 associated CPEs
Vendor Product Version / Range
Linux Linux 603d5a7110832e10165d21f9a1486399457177de
Linux Linux 5d29d7ff8679e5a525f22da467ba33c042e8029b
Linux Linux f58752ebcb35e156c85cd1a82d6579c7af3b9023
Linux Linux f58752ebcb35e156c85cd1a82d6579c7af3b9023
Linux Linux d826061aa64cb28089bf4c73e301dd7928662b84
Linux Linux 8fb82e3555a7d56a05d8ef0edee9859f889c0860
Linux Linux 283f8162cc3c82086537cbc7dc01870dbeb07a91
Linux Linux f77f10bc76c2da86b4248269472f6d971e37828b
Linux Linux 6.12.83
Linux Linux 6.18.24
Linux Linux 6.1.175
Linux Linux 6.6.136
Linux Linux 6.19.14
Linux Linux 7.0.1
Linux Linux 7.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a use-after-free issue in the USB CDC-ACM driver. When a USB serial port is closed, the shutdown process incorrectly resubmits URBs (USB Request Blocks) even after disconnection, leading to potential memory corruption if those URBs are freed during concurrent operations.

Detection Guidance

This vulnerability is specific to the Linux kernel's USB CDC-ACM driver and requires kernel-level inspection. Detection involves checking kernel logs for USB-related errors or crashes, particularly during USB device disconnection. Commands like dmesg | grep -i cdc-acm or journalctl -k | grep -i cdc-acm may reveal issues. Ensure your kernel version is updated to a patched release.

Impact Analysis

This flaw could cause system crashes, kernel memory corruption, or privilege escalation if exploited. Users with physical or logical access to the system might trigger the issue via USB devices, potentially leading to denial-of-service or arbitrary code execution.

Mitigation Strategies

Update the Linux kernel to the latest stable version that includes the fix for CVE-2026-98773. Avoid using USB CDC-ACM devices until patched. Monitor kernel logs for unusual USB-related errors. If affected, disable USB CDC-ACM functionality temporarily until the update is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98773. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart