Cloudanix VulnDB

CVE-2026-98696

None

CVSS

—

EPSS

0.2%

Published

Oct 18, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A driver unloading bug in the Linux kernel could let attackers crash the system or gain higher privileges when USB serial devices are attached and removed.

Exploitation
Local Privilege
Attacker needs
High Privilege
Complexity
Moderate
Impact
Full Compromise
Component
OS kernel
Class
Use After Free
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Use-after-free in USB serial completion handlers caused by deregistering port drivers before the USB bus driver, allowing in-flight I/O to reference freed port data structures.

Why it matters to the business

Kernel crashes or potential local privilege escalation on systems handling USB serial devices during driver unload, increasing risk for servers, embedded devices, and workstations with frequent USB peripheral changes.

How an attack unfolds

An attacker with local access triggers repeated load/unload of a USB serial driver module while I/O operations are pending on attached ports, causing completion handlers to dereference freed memory after the incorrect deregistration order.

How to fix it

Upgrade to a Linux kernel containing the USB serial driver deregistration order fix; ensure any custom or out-of-tree USB serial modules are rebuilt against the patched kernel.

How to confirm the fix worked

Confirm the kernel source contains the updated registration sequence that removes new_id attributes before USB driver deregistration and performs USB deregistration before port driver teardown; test by loading/unloading the module under I/O load.

Typical attack path

  1. Obtain local unprivileged access on a Linux system with USB serial support
  2. Attach or simulate a USB serial device that binds to the vulnerable driver
  3. Trigger concurrent I/O on the serial port
  4. Force module unload to hit the faulty deregistration sequence
  5. Leverage resulting UAF for memory corruption and privilege escalation

How to detect it

Review kernel logs for USB serial driver unload sequences coinciding with use-after-free reports or oops in completion handlers; correlate with module load/unload events and USB device attach/detach timestamps.

What your security team should do

  • Prioritize kernel updates on systems exposing USB serial interfaces to untrusted users or devices
  • Monitor EPSS and exploit maturity for any rise in public PoCs
  • Apply defense-in-depth: restrict unprivileged module loading via LSM policies

The record

In the Linux kernel, the following vulnerability has been resolved: USB: serial: fix driver deregistration order USB serial driver modules register one driver for the USB bus and one or more drivers for the ports on the USB serial bus. When unloading a driver module, the USB driver must be deregistered before the USB serial bus drivers so that I/O is stopped before unbinding the ports to avoid use-after-free in completion handlers accessing port data. Note that the "new_id" attributes must first be removed to prevent new ids from being added and triggering a probe of the USB driver after it has been deregistered.

Affected packages

Ecosystem Package Introduced Fixed