Cloudanix VulnDB

CVE-2026-98933

None

CVSS

—

EPSS

0.2%

Published

Oct 23, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A timing problem when USB connections wake up can cause computers to crash if devices connect and disconnect very often.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Low
Impact
Denial Of Service
Component
OS kernel
Class
Race Condition
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Excessive 200ms PM runtime reference hold during USB3 root hub resume triggers AMD platform crashes under repeated resume conditions from frequent polling.

Why it matters to the business

System instability and crashes disrupt operations for users performing frequent USB device interactions, increasing support burden and potential downtime on affected AMD platforms.

How an attack unfolds

Repeated USB subsystem wake events from polling tools cause successive hub resumes; the prolonged hold time exceeds AMD platform tolerances leading to crashes without requiring special privileges.

How to fix it

Apply kernel patches that reduce the post-resume hold time to 120ms specifically for USB3 root hubs while retaining 200ms for external hubs; alternatively disable USB runtime PM as a workaround.

How to confirm the fix worked

Verify updated kernel source or binary contains the 120ms hold time change for SS root hubs; reproduce with continuous adb polling and confirm absence of platform crashes.

Typical attack path

  1. Initiate repeated USB device polling or wake events
  2. Trigger successive root hub resume sequences
  3. Accumulate PM runtime hold time beyond platform limit
  4. Induce kernel or platform crash

How to detect it

Inspect kernel logs for USB hub resume entries followed by platform crash signatures; correlate with high-frequency USB polling activity in process or device logs.

What your security team should do

  • Prioritize kernel updates containing the reduced hold time fix within standard patching cycles
  • Monitor dmesg and USB subsystem logs for resume-related crashes on AMD hardware
  • Evaluate USB runtime PM configuration as temporary mitigation where updates are delayed

The record

In the Linux kernel, the following vulnerability has been resolved: usb: hub: use shorter 120ms post resume hold for SS root hubs Holding a USB3 hub PM runtime reference for 200ms at hub resume triggers an AMD platform issue. Users running Android adb report crashes after adb has been polling and waking up the USB subsystem once a second for some time. Vendors are working on a solution. Disabling USB runtime PM is one way to prevent this issue, but it is also proven that reducing the hold time to 120ms in resume also mitigates it. See Link for more details. Reducing the hold time to 120ms for the USB3 roothub is in itself a valid change and optimization, as the current 200ms is excessive: a root hub has no upstream suspended hub whose wake propagation needs to be accounted for, but still need some time for USB3 link training to complete. Keep the 200ms hold for external hubs that commit 8f5b7e2bec1c ("usb: hub: fix detection of high tier USB3 devices behind suspended hubs") is intended for.

Affected packages

Ecosystem Package Introduced Fixed