In the Linux kernel, the following vulnerability has been resolved: USB: gadget: dummy-hcd: Fix wait for outstanding request completions The… (CVE-2026-98765)

The Linux kernel dummy-hcd driver emulates synchronize_irq() by waiting for its private callback_usage counter to drop to zero without holding the private lock. This counter increments on gadget driver callbacks but not on request completion handlers. Since request completions are triggered by timer interrupts, the lack of incrementing the counter during completion callbacks allowed the unbind routine to execute prematurely, potentially unloading the module while completion handlers were active. The fix increments the callback_usage counter during request completion callbacks to ensure proper synchronization.

If exploited, this vulnerability could cause a gadget driver's unbind routine to execute before all outstanding request completions have finished, potentially leading to the module being unloaded while a completion handler is still running. This could cause undefined behavior, including crashes or memory corruption in the kernel.

A fix has been implemented in the Linux kernel to increment the callback_usage counter during request completion callbacks, addressing the synchronization oversight. Users should update to the patched kernel version containing this fix. No additional mitigation steps are indicated.