What’s Vulnerable › Vulnerabilities

CVE-2026-98697: USB: serial: fix dynamic id driver deregistration race

• Severity: unknown
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-18 · updated 2026-10-30

Description

In the Linux kernel, the following vulnerability has been resolved: USB: serial: fix dynamic id driver deregistration race Only free the dynamic ids after having deregistered the driver and removed the "new_id" attribute to avoid leaking any id added by a racing write to the attribute.

Affected products

• Linux: 2.6.21 — fixed in 7.3

How to fix

Upgrade to a fixed version: Linux 7.3. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/025e149e471bfa07622b8b77050facfc9b7704b4
• https://git.kernel.org/stable/c/29172161236154f362e35694864cacbdeb07d060
• https://git.kernel.org/stable/c/380f57cd58e26e0f3687451196ec446c473c52d9
• https://git.kernel.org/stable/c/4d6da6867b4ac6468d634a0dd3c35dfc0dc8af81
• https://git.kernel.org/stable/c/5f83c41fac8f4048f2ded4ffdd74907888a3bb91
• https://git.kernel.org/stable/c/63594e8ffe097bc0b7639936f33799a7653dded2
• https://git.kernel.org/stable/c/e8dd520070e1d89ab2fabdd514dd2b4024fabc1f
• https://git.kernel.org/stable/c/ebd8fcaaacb66c15ae7e19d14619abe3762e0701

Get alerted when CVE-2026-98697 or the next vulnerability affects your stack