Cloudanix VulnDB

CVE-2026-98772

None

CVSS

—

EPSS

0.2%

Published

Oct 18, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in how the operating system cleans up USB connections on certain hardware could cause crashes or other problems until the system is updated.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Privilege Gain
Component
OS kernel
Class
Use After Free
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Use-after-free in Linux kernel USB serial multiport drivers where completion handlers can access freed port driver data due to a race between port tear-down and URB handling during disconnect or close.

Why it matters to the business

Potential kernel crashes, denial of service on systems with multiport USB serial hardware, and in theory local code execution; low real-world risk given no known exploitation five days after disclosure.

How an attack unfolds

An attacker with local access and the ability to trigger repeated attach/detach or open/close cycles on a vulnerable multiport USB serial device could attempt to win the race between port deregistration and a pending URB completion handler, leading to a use-after-free access; no public exploits or threat actor campaigns are known.

How to fix it

Update to a kernel containing the fix that reorders disconnect handling to ensure all I/O is stopped and driver disconnect callbacks complete before ports are deregistered; apply vendor-supplied kernel updates as they become available.

How to confirm the fix worked

Confirm the installed kernel version contains the reordered disconnect logic described in the fix; review dmesg or kernel logs after USB serial device attach/detach cycles for absence of use-after-free warnings or crashes.

Typical attack path

  1. Obtain local access to a system with a multiport USB serial device
  2. Repeatedly attach/detach the device or open/close ports to trigger URB submission and completion paths
  3. Time operations to race port tear-down with a completion handler that dereferences freed driver data
  4. Trigger kernel memory corruption or crash

How to detect it

Review kernel logs for USB serial related oops, warnings, or use-after-free reports around device disconnect events; no specific post-exploitation artifacts are known.

What your security team should do

  • Prioritize kernel updates on systems exposing USB serial hardware
  • Monitor upstream kernel changelogs for backported fixes in distribution kernels
  • Limit unprivileged local access on systems that use multiport USB serial devices until patched

The record

In the Linux kernel, the following vulnerability has been resolved: USB: serial: fix port tear down use-after-free Some drivers for multiport devices access port driver data from completion handlers of shared URBs submitted at attach() or first open() and stopped at disconnect() or last close(), respectively. A simple NULL check before accessing the driver data makes sure that a port state container has at least been allocated, but a completion handler can still race with port tear down. Reorder the disconnect handling so that ports are not deregistered (and their driver data freed) until after all ports have been hung up and the driver disconnect() callback has run so that all I/O has been stopped.

Affected packages

Ecosystem Package Introduced Fixed