In the Linux kernel, the following vulnerability has been resolved: usb: hub: use shorter 120ms post resume hold for SS root hubs Holding a USB3 hub… (CVE-2026-98933)

The Linux kernel USB hub driver held a USB3 hub power management runtime reference for 200ms after resume, which triggered an issue on AMD platforms causing system crashes during frequent USB subsystem wake-ups, such as those caused by Android adb polling. The vulnerability was mitigated by reducing the post-resume hold time to 120ms for USB3 root hubs, which is sufficient for USB3 link training and avoids the excessive delay. External hubs retain the 200ms hold time due to their different wake propagation requirements. This change both resolves the AMD platform issue and optimizes USB3 root hub resume behavior.

Systems running the affected Linux kernel versions on AMD platforms could experience crashes when the USB subsystem is frequently woken, for example by Android adb polling. This could lead to system instability or denial of service conditions during USB resume operations involving USB3 root hubs.

A fix is available that reduces the USB3 root hub post-resume hold time to 120ms, mitigating the issue. Disabling USB runtime power management is an alternative workaround but less optimal. Users and vendors should apply the updated Linux kernel version containing this fix once available.