In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: gadget: fix IRQ storm on invalid event buffer count When… (CVE-2026-98767)

The Linux kernel's USB DWC3 gadget driver had a flaw where dwc3_check_event_buf() would return IRQ_NONE without clearing the GEVNTCOUNT register if the event count exceeded the buffer length. Because the DWC3 interrupt is level-triggered, the uncleared interrupt line causes a continuous IRQ storm, accumulating tens of thousands of unhandled interrupts and triggering a kernel BUG at spurious.c:184. The issue can be reproduced by writing an invalid value exceeding the event buffer length directly to the GEVNTCOUNT register. The fix involves writing the bogus count back to clear the IRQ source and scheduling error recovery to reinitialize the controller.

This vulnerability causes a kernel panic due to an interrupt storm triggered by an invalid event buffer count in the USB DWC3 gadget driver. The kernel panic can lead to denial of service on affected systems.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is applied, avoid conditions that could cause invalid event buffer counts in the DWC3 USB gadget driver. The described fix involves clearing the interrupt source by writing back the bogus count and scheduling error recovery, but official patches or updates should be monitored.