CVE-2026-98765USB: gadget: dummy-hcd: Fix wait for outstanding request completions
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: USB: gadget: dummy-hcd: Fix wait for outstanding request completions The dummy-hcd driver emulates synchronize_irq() by waiting until its private callback_usage counter drops to 0 (with the private lock not held). This counter is incremented whenever a gadget driver callback occurs (which requires the private lock to be dropped), but not when a request completion handler is called. This is an oversight. Request completion is triggered by timer interrupts (emulating device IRQs in a real UDC), and the interrupt handlers are supposed to have completed when the synchronize_irq() emulation routine returns -- they aren't supposed to be in the middle of a completion callback. If this happens it can lead to a gadget driver's unbind routine running before all outstanding request completions have finished, maybe even allowing the gadget driver's module to be unloaded while a completion handler is still running. Fix the oversight by incrementing the callback_usage value across request completion callbacks.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 18, 2026
- First seen by InfoSec Signals
- Oct 18, 2026
Affected products
Linux Linux linux:linux (from the name) | 7dbd8f4cabd96db5a50513de9d83a8105a5ffc81 builds before 7ce4dca0d53b1c3cb2b7e7bb2e42bf5db860caf2; from 7dbd8f4cabd96db5a50513de9d83a8105a5ffc81 before 5298c96bf0068f3160969f7ddad81976d01a9b66; from 7dbd8f4cabd96db5a50513de9d83a8105a5ffc81 before 3070806a7bc7bb36ed04a21022c09dafcc5619f4; from 7dbd8f4cabd96db5a50513de9d83a8105a5ffc81 before b263ff9b0fc5c1f371d65c4eb196b31263d039ff; 7b416b9dac6ede26d4ca0c1a88b448b543623ff3; 8590bc1da625dd4a589eac0fc3aa3cf4f400424d; a867d5b932ac4911d3f8a1e63505061b0c81f889; e84b4a008365b7edbd842a063ae28d040a98db25; and 8 more ranges | CNA record |
References
- https://git.kernel.org/stable/c/7ce4dca0d53b1c3cb2b7e7bb2e42bf5db860caf2
- https://git.kernel.org/stable/c/5298c96bf0068f3160969f7ddad81976d01a9b66
- https://git.kernel.org/stable/c/3070806a7bc7bb36ed04a21022c09dafcc5619f4
- https://git.kernel.org/stable/c/b263ff9b0fc5c1f371d65c4eb196b31263d039ff
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.