CVE-2026-98696USB: serial: fix driver deregistration order
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: USB: serial: fix driver deregistration order USB serial driver modules register one driver for the USB bus and one or more drivers for the ports on the USB serial bus. When unloading a driver module, the USB driver must be deregistered before the USB serial bus drivers so that I/O is stopped before unbinding the ports to avoid use-after-free in completion handlers accessing port data. Note that the "new_id" attributes must first be removed to prevent new ids from being added and triggering a probe of the USB driver after it has been deregistered.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 18, 2026
- First seen by InfoSec Signals
- Oct 18, 2026
Affected products
Linux Linux linux:linux (from the name) | 765e0ba62613fb90f09c1b5926750df0aa56f349 builds before 9b085a06a0a411b0bcdf18b61c3ebf1be1c72ffe; from 765e0ba62613fb90f09c1b5926750df0aa56f349 before a1aa474768f69ea3a70da523f00f74c264cfa10e; 765e0ba62613fb90f09c1b5926750df0aa56f349 builds before 428d479a0d31460fbf5969ab262ccd673f1fac01; 765e0ba62613fb90f09c1b5926750df0aa56f349 builds before 646e5b28b4fdbc1b828a2398d6ced2c1dd308a46 | CNA record |
References
- https://git.kernel.org/stable/c/9b085a06a0a411b0bcdf18b61c3ebf1be1c72ffe
- https://git.kernel.org/stable/c/a1aa474768f69ea3a70da523f00f74c264cfa10e
- https://git.kernel.org/stable/c/428d479a0d31460fbf5969ab262ccd673f1fac01
- https://git.kernel.org/stable/c/646e5b28b4fdbc1b828a2398d6ced2c1dd308a46
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.