In the Linux kernel, the following vulnerability has been resolved: usb: core: clear both ep_in and ep_out for non-ep0 control endpoints In… (CVE-2026-98763)

The vulnerability involved the usb_disable_endpoint() function in the Linux kernel USB core, which failed to clear both dev->ep_in[epnum] and dev->ep_out[epnum] pointers for non-zero control endpoints when reset_hardware was set. This could leave one direction's endpoint pointer referencing a disabled or freed endpoint, potentially causing use-after-free or stale pointer issues. The patch updates usb_disable_endpoint() to clear both pointers and adjusts documentation accordingly. Testing was performed on Linux 7.3.0-rc3 with QEMU using dummy_hcd and raw-gadget to verify the fix.

The issue could lead to stale pointers referencing disabled or freed USB endpoints, which might cause kernel instability or memory corruption. However, no known exploits in the wild have been reported. The impact is limited to USB endpoint management within the Linux kernel.

A fix has been implemented in the Linux kernel to clear both ep_in and ep_out pointers when disabling non-ep0 control endpoints with reset_hardware set. Users should update to a Linux kernel version that includes this patch. Since the vulnerability is resolved in the kernel source, applying the official kernel update is the recommended mitigation.