All vulnerabilities
CVE-2026-98772

Linux: USB: serial: fix port tear down use-after-free

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.17%Chance of exploitation activity in the next 30 days, higher than 5% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in60cc9379c3e650d1ebfba4de63f1242537a62a32Also 5e8980a81af195c49084be5b4c031085b56c7443, 33c920f7c5952dfc42d1b8ea6efe16b1f0bb0c5bCVE List
Published18 Oct 2026Updated 21 Oct 2026CVE List

What fixes it

  • 60cc9379c3e650d1ebfba4de63f1242537a62a32LinuxCVE List
  • 5e8980a81af195c49084be5b4c031085b56c7443LinuxCVE List
  • 33c920f7c5952dfc42d1b8ea6efe16b1f0bb0c5bLinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

USB: serial: fix port tear down use-after-free

Some drivers for multiport devices access port driver data from completion handlers of shared URBs submitted at attach() or first open() and stopped at disconnect() or last close(), respectively.

A simple NULL check before accessing the driver data makes sure that a port state container has at least been allocated, but a completion handler can still race with port tear down.

Reorder the disconnect handling so that ports are not deregistered (and their driver data freed) until after all ports have been hung up and the driver disconnect() callback has run so that all I/O has been stopped.

Text from CVE List

Affected versions 12

  • Linuxaffected: 2d93148ab6988cad872e65d694c95e8944e1b626 before e4a6883ad9b4686a5f4bd90ff55a44d7ab65bd3cCVE List
  • Linuxaffected: 2d93148ab6988cad872e65d694c95e8944e1b626 before 60cc9379c3e650d1ebfba4de63f1242537a62a32CVE List
  • Linuxaffected: 2d93148ab6988cad872e65d694c95e8944e1b626 before 5e8980a81af195c49084be5b4c031085b56c7443CVE List
  • Linuxaffected: 2d93148ab6988cad872e65d694c95e8944e1b626 before e80ee74206f260eb1282e7d1339ff146a4a410d0CVE List
  • Linuxaffected: 2d93148ab6988cad872e65d694c95e8944e1b626 before 33c920f7c5952dfc42d1b8ea6efe16b1f0bb0c5bCVE List
  • Linuxaffected: 2.6.30CVE List
  • Linuxunaffected: all versions before 2.6.30CVE List
  • Linuxunaffected: 6.6.160 through 6.6.*CVE List
  • Linuxunaffected: 6.12.113 through 6.12.*CVE List
  • Linuxunaffected: 6.18.56 through 6.18.*CVE List
  • Linuxunaffected: 7.2.10 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 5