Cloudanix VulnDB

CVE-2026-98773

None

CVSS

—

EPSS

0.2%

Published

Oct 18, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A timing bug in Linux USB handling for certain serial devices can let the system crash or be hijacked if a device is removed at exactly the wrong moment.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Privilege Gain
Component
OS kernel
Class
Use After Free
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Use-after-free in the Linux kernel CDC-ACM USB driver where acm_port_shutdown unconditionally unpoisons and resubmits URBs after acm_disconnect has already poisoned and scheduled them for free, allowing in-flight DMA accesses in acm_ctrl_irq or acm_read_bulk_callback to touch freed memory.

Why it matters to the business

Kernel crashes or potential local privilege escalation on Linux systems that use USB CDC-ACM devices such as certain modems and serial adapters, with possible operational disruption even though current exploitation activity remains low.

How an attack unfolds

A local attacker opens a TTY port for a CDC-ACM USB device, then forces a concurrent disconnect and port close so that the shutdown path re-submits URBs that the disconnect path immediately frees, triggering the use-after-free in the IRQ or bulk callbacks.

How to fix it

Apply the upstream kernel patch that adds a disconnected check after the delayed-anchor drain in acm_port_shutdown and return early when the flag is set; rebuild and deploy the fixed kernel on all affected systems.

How to confirm the fix worked

Confirm the fix is present by inspecting the cdc-acm.c source for the early return after the wb-use and autopm accounting loop when acm->disconnected is true; test by attaching a CDC-ACM device, exercising port open/close under disconnect, and verifying absence of use-after-free reports.

Typical attack path

  1. Obtain local shell or equivalent access on the target Linux system
  2. Open the TTY device node for an attached CDC-ACM USB peripheral
  3. Trigger device disconnect while the port is still open
  4. Cause acm_port_shutdown to execute after poisoning but before URB freeing completes
  5. Access freed DMA memory from acm_ctrl_irq or acm_read_bulk_callback

How to detect it

Search kernel logs and crash dumps for use-after-free reports referencing acm_ctrl_irq or acm_read_bulk_callback, especially around USB disconnect or tty close events; correlate with CDC-ACM device attach/detach timestamps.

What your security team should do

  • Expedite kernel updates on any system exposing CDC-ACM TTY ports
  • Limit unprivileged local access to USB device nodes until patched
  • Add kernel oops and cdc-acm callback crash signatures to monitoring rules

The record

In the Linux kernel, the following vulnerability has been resolved: USB: cdc-acm: skip URB restart in port_shutdown if disconnected acm_port_shutdown() is called from the tty-port machinery whenever the last user closes the port. acm_disconnect() sets acm->disconnected and calls tty_port_tty_vhangup(), which eventually triggers port_shutdown(). At that point acm_disconnect() has already called acm_poison_urbs() and is about to free the control and read URBs. However, acm_port_shutdown() unconditionally calls acm_unpoison_urbs() and, when the ALWAYS_POLL_CTRL quirk is set, immediately re-submits the ctrlurb and all read URBs. If the concurrent acm_disconnect() then frees those URBs and their DMA buffers while they are in-flight, the result is a use-after-free in acm_ctrl_irq() or acm_read_bulk_callback() accessing the freed DMA memory. Fix by checking acm->disconnected after draining the delayed anchor and returning early: if we are in a disconnect path the URBs must remain poisoned and must not be resubmitted. The early return is placed after the delayed-anchor drain loop because that loop only cancels write-side accounting (wb->use = false and autopm counter) and does not touch the hardware path.

Affected packages

Ecosystem Package Introduced Fixed