In the Linux kernel, the following vulnerability has been resolved: USB: cdc-acm: skip URB restart in port_shutdown if disconnected… (CVE-2026-98773)

The vulnerability in the Linux kernel's USB cdc-acm driver arises because acm_port_shutdown() unconditionally calls acm_unpoison_urbs(), which resubmits control and read URBs if the ALWAYS_POLL_CTRL quirk is set. If acm_disconnect() concurrently frees these URBs and their DMA buffers, use-after-free occurs in acm_ctrl_irq() or acm_read_bulk_callback() when accessing freed memory. The patch adds a check for acm->disconnected after draining the delayed anchor to return early and prevent URB resubmission during disconnect, ensuring poisoned URBs remain so and are not resubmitted.

This vulnerability can lead to use-after-free conditions in kernel USB driver code, potentially causing kernel crashes or memory corruption. However, no known exploits in the wild have been reported. The impact is limited to affected Linux kernel USB cdc-acm driver operations involving device disconnect and port shutdown.

A fix is available that adds a check to prevent URB resubmission during device disconnect in the USB cdc-acm driver. Users should apply the official Linux kernel update that includes this patch to remediate the vulnerability.