CVE-2026-98765: USB: gadget: dummy-hcd: Fix wait for outstanding request completions

Severity: unknown
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-18 · updated 2026-10-30

Description

In the Linux kernel, the following vulnerability has been resolved: USB: gadget: dummy-hcd: Fix wait for outstanding request completions The dummy-hcd driver emulates synchronize_irq() by waiting until its private callback_usage counter drops to 0 (with the private lock not held). This counter is incremented whenever a gadget driver callback occurs (which requires the private lock to be dropped), but not when a request completion handler is called. This is an oversight. Request completion is triggered by timer interrupts (emulating device IRQs in a real UDC), and the interrupt handlers are supposed to have completed when the synchronize_irq() emulation routine returns -- they aren't supposed to be in the middle of a completion callback. If this happens it can lead to a gadget driver's unbind routine running before all outstanding request completions have finished, maybe even allowing the gadget driver's module to be unloaded while a completion handler is still running. Fix the oversight by incrementing the callback_usage value across request completion callbacks.

Affected products

Linux: from 3.2.97 before 3.3; from 3.16.52 before 3.17; from 4.1.46 before 4.2; from 4.4.92 before 4.5; from 4.9.55 before 4.10; from 4.13.6 before 4.14 — fixed in 3.3, 3.17, 4.2, 4.5, 4.10, 4.14

How to fix

Upgrade to a fixed version: Linux 3.3, 3.17, 4.2, 4.5. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-98765 or the next vulnerability affects your stack