A vulnerability in the Linux kernel's usb gadget driver f_uac1_legacy allows out-of-bounds access due to improper validation of the bRequest index in generic_set_cmd() and generic_get_cmd(). This can be triggered by a malicious USB host sending crafted SET_CUR or GET_CUR requests, causing heap memory corruption.
A vulnerability in the Linux kernel's usb typec anx7411 driver was fixed by ensuring the IRQ is stopped before destroying the workqueue. The IRQ is devm-managed and could queue work during removal, causing potential issues. This flaw affects multiple specific Linux kernel versions.
A vulnerability in the Linux kernel's USB DWC3 gadget driver causes an interrupt request (IRQ) storm due to improper handling of an invalid event buffer count. When the event count exceeds the buffer length, the interrupt line remains asserted, leading to a kernel panic triggered by spurious interrupts.
A use-after-free vulnerability exists in the Linux kernel's usb gadget driver for aspeed-vhub. The issue arises because a wake work item is not properly cancelled during device removal, allowing a queued work item to run after the device and its ports have been freed. This can lead to unsafe memory access. The fix involves cancelling the work item correctly and adding synchronization to prevent re-arming the work after cancellation.
A vulnerability in the Linux kernel's dummy-hcd USB gadget driver could allow a gadget driver's unbind routine to run before all outstanding request completions have finished. This flaw arises because the driver does not properly track request completion callbacks, potentially permitting the gadget driver's module to be unloaded while a completion handler is still running. The issue has been fixed by adjusting the callback usage counter to include request completion callbacks.
CVE-2026-98764 is a vulnerability in the Linux kernel's USB gadget FunctionFS driver where a NULL pointer dereference can occur. This happens when user space sets up FunctionFS with only full-speed descriptors but the gadget operates at a higher speed. The kernel attempts to access a descriptor index that does not exist, causing a kernel panic. The issue is fixed by implementing fallback logic to lower speed descriptors and safely returning an error if no valid descriptor is found.
A vulnerability in the Linux kernel USB core affects the handling of non-ep0 control endpoints. Specifically, when disabling such endpoints with reset_hardware set, only one direction's endpoint pointer is cleared, leaving the other pointing to a disabled or freed endpoint. This flaw has been fixed by ensuring both endpoint pointers (ep_in and ep_out) are cleared. The issue was tested and resolved in Linux kernel 7.3.0-rc3.
A vulnerability in the Linux kernel USB driver (dwc2) involves improper handling of the wakeup timer during host controller driver (HCD) state freeing. The wakeup timer is not shut down before freeing HCD state, which can lead to timer callbacks accessing freed memory. This issue has been resolved by ensuring the timer is stopped and shut down before HCD resources are freed.
CVE-2026-98761 is a vulnerability in the Linux kernel's USB Type-C Port Manager (tcpm) related to handling the FAST_ROLE_SWAP (FRS) Alternate Mode State (AMS). The flaw occurs when the tcpm fails to start the FRS AMS, leaving VBUS power sourcing enabled incorrectly after a cable disconnect event. This can cause the port to remain in an invalid state without proper reset, potentially leading to unexpected behavior in USB Type-C power role swapping.
A vulnerability in the Linux kernel's USB Type-C driver (tipd) was fixed by zero-initializing the typec_partner_desc structure in the tps6598x_connect() function. Previously, some fields were left uninitialized, potentially leading to garbage function pointers being invoked and leakage of stack data via sysfs.
A vulnerability in the Linux kernel's USB Type-C driver (tipd) was fixed by zero-initializing the typec_partner_desc structure in the cd321x_update_work() function. Previously, uninitialized fields could lead to garbage function pointers being invoked and potential leakage of stack data via sysfs. This issue affects specific Linux kernel versions and has a medium severity rating.
A use-after-free vulnerability in the Linux kernel's USB Type-C UCSI glink driver was fixed. The issue involved work items running after the UCSI instance was unregistered, causing access to freed memory. This was addressed by disabling work items before unregistering and ensuring the instance is only unregistered if still registered. The flaw was found via static analysis and affects specific Linux kernel versions.
A use-after-free vulnerability in the Linux kernel's cdns3 USB gadget driver was fixed. The issue occurs because cdns3_gadget_exit() does not wait for deferred work handlers to complete before freeing resources, potentially allowing use of freed memory. This flaw was identified by static analysis and affects specific Linux kernel versions.
A NULL pointer dereference vulnerability exists in the Linux kernel's usb: cdns3 driver during the PCI probe process. This occurs when the second function of the Cadence USBSS controller is probed before the first function has set its driver data, leading to a kernel crash. The issue is resolved by deferring the probe until the first function completes its initialization.
A vulnerability in the Linux kernel's tty vcc component involved a control packet structure that was not fully zero-initialized before being sent, potentially leaking kernel stack data to a peer. This issue has been resolved by ensuring the control packet is zero-initialized prior to use.
CVE-2026-98754 is a use-after-free vulnerability in the Linux kernel's tty vcc driver. The issue occurs because vcc_cleanup() clears the tty pointer without holding the required port lock, leading to a race condition with callbacks that access the tty pointer under the lock. This can cause a callback to dereference a freed tty port, potentially leading to memory corruption or system instability.
CVE-2026-98753 is a vulnerability in the Linux kernel's tty subsystem where the TTY_IO_ERROR flag is not restored on activation failure. This flaw can lead to kernel panics or NULL-pointer dereferences when accessing powered down or deregistered TTY ports due to race conditions between ioctl calls and port hangups. The issue occurs because the flag is only reset during tty_port_close(), leaving a window where drivers may mishandle ioctl-hangup races.
A race condition vulnerability in the Linux kernel's tty port handling was fixed by adding missing serialization to the tty_port_tty_vhangup() and tty_port_hangup() functions. The flaw could cause use-after-free and NULL-pointer dereferences during concurrent hangup operations, potentially leading to kernel instability or crashes.
CVE-2026-98751 is a vulnerability in the Linux kernel's tty subsystem involving a race condition between break signalling ioctls and hangup events. This race can cause calls into a tty driver for a device that may no longer be present or powered down. The issue has been addressed by requiring drivers to handle this race properly and abort break signalling to avoid unsafe callbacks after user-controlled timeouts or device reopenings.
A race condition vulnerability in the Linux kernel's TTY subsystem involving saved termios reset on device registration has been fixed. The issue arises when a minor device number is reused for a different device without properly resetting saved termios state, potentially causing a use-after-free condition. This can prevent the port from opening under certain settings. The fix introduces a new flag to ensure saved termios state is reset only when safe.