All vulnerabilities
CVE-2026-98773

Linux: USB: cdc-acm: skip URB restart in port_shutdown if disconnected

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.17%Chance of exploitation activity in the next 30 days, higher than 5% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in9742905d9ed5bf23ebe4c100dec80b6bc50fb522Also 420ca35af891d33522cc08504768ccd60a4c450a, 6.6.160 and 5 moreCVE List
Published18 Oct 2026Updated 21 Oct 2026CVE List

What fixes it

Show all 8 fixed versions

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

USB: cdc-acm: skip URB restart in port_shutdown if disconnected

acm_port_shutdown() is called from the tty-port machinery whenever the last user closes the port. acm_disconnect() sets acm->disconnected and calls tty_port_tty_vhangup(), which eventually triggers port_shutdown(). At that point acm_disconnect() has already called acm_poison_urbs() and is about to free the control and read URBs.

However, acm_port_shutdown() unconditionally calls acm_unpoison_urbs() and, when the ALWAYS_POLL_CTRL quirk is set, immediately re-submits the ctrlurb and all read URBs. If the concurrent acm_disconnect() then frees those URBs and their DMA buffers while they are in-flight, the result is a use-after-free in acm_ctrl_irq() or acm_read_bulk_callback() accessing the freed DMA memory.

Fix by checking acm->disconnected after draining the delayed anchor and returning early: if we are in a disconnect path the URBs must remain poisoned and must not be resubmitted.

The early return is placed after the delayed-anchor drain loop because that loop only cancels write-side accounting (wb->use = false and autopm counter) and does not touch the hardware path.

Text from CVE List

Affected versions 21

  • Linuxaffected: 8fb82e3555a7d56a05d8ef0edee9859f889c0860 before d86775e79838d7d2e38ccf506a7d0f8e2dd4d5d0CVE List
  • Linuxaffected: 603d5a7110832e10165d21f9a1486399457177de before 9742905d9ed5bf23ebe4c100dec80b6bc50fb522CVE List
  • Linuxaffected: 5d29d7ff8679e5a525f22da467ba33c042e8029b before a0ed07b5bbb2d8fcef86810453216070691816e7CVE List
  • Linuxaffected: f58752ebcb35e156c85cd1a82d6579c7af3b9023 before 420ca35af891d33522cc08504768ccd60a4c450aCVE List
  • Linuxaffected: f58752ebcb35e156c85cd1a82d6579c7af3b9023 before dc614d6bc991740d41d5a99ac7765c4b675dda88CVE List
  • Linuxaffected: d826061aa64cb28089bf4c73e301dd7928662b84CVE List
  • Linuxaffected: 283f8162cc3c82086537cbc7dc01870dbeb07a91CVE List
  • Linuxaffected: f77f10bc76c2da86b4248269472f6d971e37828bCVE List
  • Linuxaffected: 6.6.136 before 6.6.160CVE List
  • Linuxaffected: 6.12.83 before 6.12.113CVE List
  • Linuxaffected: 6.18.24 before 6.18.56CVE List
  • Linuxaffected: 6.1.175 before 6.2CVE List
  • Linuxaffected: 6.19.14 before 6.20CVE List
  • Linuxaffected: 7.0.1 before 7.1CVE List
  • Linuxaffected: 7.1CVE List
  • Linuxunaffected: all versions before 7.1CVE List
  • Linuxunaffected: 6.6.160 through 6.6.*CVE List
  • Linuxunaffected: 6.12.113 through 6.12.*CVE List
  • Linuxunaffected: 6.18.56 through 6.18.*CVE List
  • Linuxunaffected: 7.2.10 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 5