In the Linux kernel, the following vulnerability has been resolved: USB: serial: fix driver deregistration order USB serial driver modules register… (CVE-2026-98696)

The Linux kernel USB serial driver modules register one driver for the USB bus and one or more drivers for the ports on the USB serial bus. When unloading a driver module, the USB driver must be deregistered before the USB serial bus drivers to ensure I/O is stopped before unbinding the ports. Failure to do so can cause use-after-free vulnerabilities in completion handlers that access port data. The fix involves correcting the deregistration order and ensuring that "new_id" attributes are removed first to prevent new IDs from triggering probes after deregistration.

If the deregistration order is incorrect, use-after-free conditions may occur in completion handlers accessing port data, potentially leading to kernel instability or crashes. The vulnerability could be exploited by triggering driver unload sequences that cause access to freed memory.

A fix has been implemented to correct the driver deregistration order and to remove "new_id" attributes before deregistration to prevent new probes. Users should apply the official Linux kernel updates that include this fix. No additional mitigation steps are indicated beyond applying the patch.