CVE-2026-98697

What it actually does

Race condition in USB serial driver deregistration allows a concurrent write to the new_id sysfs attribute to add a dynamic ID after the driver has begun teardown but before dynamic IDs are freed, resulting in a leaked ID entry.

Why it matters to the business

Resource leaks and potential inconsistent driver state on systems that rely on dynamic USB serial device binding, which can degrade stability or require reboots in environments with frequent USB device attach/detach or driver reloads.

How an attack unfolds

An attacker with local access triggers rapid driver deregistration while simultaneously writing a crafted ID to the new_id attribute; if the write races past the deregistration point, the ID is added to a structure that is then freed, leaving a dangling reference that could be abused for further kernel memory manipulation.

How to fix it

Upgrade to a kernel containing the referenced fix that moves dynamic-ID freeing after driver deregistration and new_id attribute removal; rebuild and reboot with the patched kernel; avoid hot-unloading USB serial drivers until updated.

How to confirm the fix worked

Confirm the presence of the upstream commit that reorders dynamic-ID cleanup relative to driver deregistration; verify that writes to new_id after deregistration no longer succeed and that no orphaned IDs remain in memory after unload.

Typical attack path

1. Obtain local unprivileged access on a vulnerable Linux kernel
2. Identify or trigger USB serial driver load/unload cycle
3. Race a write(2) to /sys/bus/usb-serial/drivers/.../new_id against the deregistration path
4. Observe or leverage the resulting leaked dynamic ID structure for subsequent kernel exploitation

How to detect it

Review kernel logs for USB serial driver registration and deregistration sequences occurring in rapid succession; inspect sysfs writes to new_id attributes around driver unload events; look for memory-leak symptoms or oops reports referencing dynamic ID structures after USB serial driver removal.

What your security team should do

• Prioritize kernel updates on systems exposing USB serial devices or performing frequent driver reloads
• Restrict unprivileged write access to USB serial sysfs attributes via LSM or mount options where possible
• Monitor for unusual USB serial driver load/unload patterns in system logs