CVE-2026-98762USB: dwc2: shut down wakeup timer before freeing HCD state
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: USB: dwc2: shut down wakeup timer before freeing HCD state dwc2_wakeup_detected() accesses the DWC2 host state and can rearm the wakeup timer. dwc2_hcd_free() currently deletes the timer only after freeing host-owned state, and timer_delete() does not synchronize a callback or prevent it from being queued again. Stop and shut down the timer in dwc2_hcd_release(), before the HCD resources are freed. This covers both the HCD initialization error path and normal HCD removal.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 18, 2026
- First seen by InfoSec Signals
- Oct 18, 2026
Affected products
Linux Linux linux:linux (from the name) | 7359d482eb4d3967cc8be354405ae6be6eaf732c builds before 441be312fce927443eae2821f502344d953c38bb; from 7359d482eb4d3967cc8be354405ae6be6eaf732c before 4333174ea52c863a50bb3e0a4726bf9f7cdf7524; 7359d482eb4d3967cc8be354405ae6be6eaf732c builds before 79ba37dd38a321cb32a79332a3e3c68dd334dca9; from 7359d482eb4d3967cc8be354405ae6be6eaf732c before fd772af9512cdecb83de34a461801533828e77fd | CNA record |
References
- https://git.kernel.org/stable/c/441be312fce927443eae2821f502344d953c38bb
- https://git.kernel.org/stable/c/4333174ea52c863a50bb3e0a4726bf9f7cdf7524
- https://git.kernel.org/stable/c/79ba37dd38a321cb32a79332a3e3c68dd334dca9
- https://git.kernel.org/stable/c/fd772af9512cdecb83de34a461801533828e77fd
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.