CVE-2026-98762

Full vulnerability record from the local CVENow database.

Description

In the Linux kernel, the following vulnerability has been resolved: USB: dwc2: shut down wakeup timer before freeing HCD state dwc2_wakeup_detected() accesses the DWC2 host state and can rearm the wakeup timer. dwc2_hcd_free() currently deletes the timer only after freeing host-owned state, and timer_delete() does not synchronize a callback or prevent it from being queued again. Stop and shut down the timer in dwc2_hcd_release(), before the HCD resources are freed. This covers both the HCD initialization error path and normal HCD removal.

Severity

Not scored

CVSS score

Not available

Vulnerability status

Received

Source identifier

416baaa9-dc9f-4396-8d5f-8c081fb06d67

Published

2026-10-18 16:17:30.013000

Last modified

2026-10-30 13:21:25.627000

View original CVE JSON

{
  "id": "CVE-2026-98762",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "published": "2026-10-18T16:17:30.013",
  "lastModified": "2026-10-30T13:21:25.627",
  "vulnStatus": "Received",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: dwc2: shut down wakeup timer before freeing HCD state\n\ndwc2_wakeup_detected() accesses the DWC2 host state and can rearm the\nwakeup timer.  dwc2_hcd_free() currently deletes the timer only after\nfreeing host-owned state, and timer_delete() does not synchronize a\ncallback or prevent it from being queued again.\n\nStop and shut down the timer in dwc2_hcd_release(), before the HCD\nresources are freed.  This covers both the HCD initialization error path\nand normal HCD removal."
    }
  ],
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "unaffected",
          "programFiles": [
            "drivers/usb/dwc2/hcd.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "7359d482eb4d3967cc8be354405ae6be6eaf732c",
              "lessThan": "f3d76baa5b902f681100447e9d185819c5c1316d",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "7359d482eb4d3967cc8be354405ae6be6eaf732c",
              "lessThan": "0b2ea59d66d046d5601ffc3e61dd09d3597c704e",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "7359d482eb4d3967cc8be354405ae6be6eaf732c",
              "lessThan": "82cc242da6d621752718929e6a2fa6f9554ebffe",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "7359d482eb4d3967cc8be354405ae6be6eaf732c",
              "lessThan": "441be312fce927443eae2821f502344d953c38bb",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "7359d482eb4d3967cc8be354405ae6be6eaf732c",
              "lessThan": "4333174ea52c863a50bb3e0a4726bf9f7cdf7524",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "7359d482eb4d3967cc8be354405ae6be6eaf732c",
              "lessThan": "79ba37dd38a321cb32a79332a3e3c68dd334dca9",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "7359d482eb4d3967cc8be354405ae6be6eaf732c",
              "lessThan": "fd772af9512cdecb83de34a461801533828e77fd",
              "versionType": "git",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "affected",
          "programFiles": [
            "drivers/usb/dwc2/hcd.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "3.10",
              "status": "affected"
            },
            {
              "version": "0",
              "lessThan": "3.10",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "5.15.224",
              "lessThanOrEqual": "5.15.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.1.191",
              "lessThanOrEqual": "6.1.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.6.160",
              "lessThanOrEqual": "6.6.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.12.113",
              "lessThanOrEqual": "6.12.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.18.56",
              "lessThanOrEqual": "6.18.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "7.2.10",
              "lessThanOrEqual": "7.2.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "7.3",
              "lessThanOrEqual": "*",
              "versionType": "original_commit_for_fix",
              "status": "unaffected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {},
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/0b2ea59d66d046d5601ffc3e61dd09d3597c704e",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/4333174ea52c863a50bb3e0a4726bf9f7cdf7524",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/441be312fce927443eae2821f502344d953c38bb",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/79ba37dd38a321cb32a79332a3e3c68dd334dca9",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/82cc242da6d621752718929e6a2fa6f9554ebffe",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/f3d76baa5b902f681100447e9d185819c5c1316d",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/fd772af9512cdecb83de34a461801533828e77fd",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ]
}