All vulnerabilities
CVE-2026-98696

Linux: USB: serial: fix driver deregistration order

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.17%Chance of exploitation activity in the next 30 days, higher than 5% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in9b085a06a0a411b0bcdf18b61c3ebf1be1c72ffeAlso 428d479a0d31460fbf5969ab262ccd673f1fac01, 646e5b28b4fdbc1b828a2398d6ced2c1dd308a46CVE List
Published18 Oct 2026Updated 21 Oct 2026CVE List

What fixes it

  • 9b085a06a0a411b0bcdf18b61c3ebf1be1c72ffeLinuxCVE List
  • 428d479a0d31460fbf5969ab262ccd673f1fac01LinuxCVE List
  • 646e5b28b4fdbc1b828a2398d6ced2c1dd308a46LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

USB: serial: fix driver deregistration order

USB serial driver modules register one driver for the USB bus and one or more drivers for the ports on the USB serial bus.

When unloading a driver module, the USB driver must be deregistered before the USB serial bus drivers so that I/O is stopped before unbinding the ports to avoid use-after-free in completion handlers accessing port data.

Note that the "new_id" attributes must first be removed to prevent new ids from being added and triggering a probe of the USB driver after it has been deregistered.

Text from CVE List

Affected versions 12

  • Linuxaffected: 765e0ba62613fb90f09c1b5926750df0aa56f349 before e7ad832b1144df19cbbaaa655625c6f984e85b9fCVE List
  • Linuxaffected: 765e0ba62613fb90f09c1b5926750df0aa56f349 before 9b085a06a0a411b0bcdf18b61c3ebf1be1c72ffeCVE List
  • Linuxaffected: 765e0ba62613fb90f09c1b5926750df0aa56f349 before a1aa474768f69ea3a70da523f00f74c264cfa10eCVE List
  • Linuxaffected: 765e0ba62613fb90f09c1b5926750df0aa56f349 before 428d479a0d31460fbf5969ab262ccd673f1fac01CVE List
  • Linuxaffected: 765e0ba62613fb90f09c1b5926750df0aa56f349 before 646e5b28b4fdbc1b828a2398d6ced2c1dd308a46CVE List
  • Linuxaffected: 3.4CVE List
  • Linuxunaffected: all versions before 3.4CVE List
  • Linuxunaffected: 6.6.160 through 6.6.*CVE List
  • Linuxunaffected: 6.12.113 through 6.12.*CVE List
  • Linuxunaffected: 6.18.56 through 6.18.*CVE List
  • Linuxunaffected: 7.2.10 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 5