USB: gadget: dummy-hcd: Fix wait for outstanding request completions
In the Linux kernel, the following vulnerability has been resolved: USB: gadget: dummy-hcd: Fix wait for outstanding request completions The dummy-hcd driver emulates synchronize_irq() by waiting until its private callback_usage counter drops to 0 (with the private lock not held). This counter is incremented whenever a gadget driver callback occurs (which requires the private lock to be dropped), but not when a request completion handler is called. This is an oversight. Request completion is triggered by timer interrupts (emulating device IRQs in a real UDC), and the interrupt handlers are supposed to have completed when the synchronize_irq() emulation routine returns -- they aren't supposed to be in the middle of a completion callback. If this happens it can lead to a gadget driver's unbind routine running before all outstanding request completions have finished, maybe even allowing the gadget driver's module to be unloaded while a completion handler is still running. Fix the oversight by incrementing the callback_usage value across request completion callbacks.
CVE-2026-98765
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-98765
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "7dbd8f4cabd96db5a50513de9d83a8105a5ffc81",
"lessThan": "6849e51b89de5b6fc7447dc8e612b58df19c7dea",
"versionType": "git"
},
{
"status": "affected",
"version": "7dbd8f4cabd96db5a50513de9d83a8105a5ffc81",
"lessThan": "7ce4dca0d53b1c3cb2b7e7bb2e42bf5db860caf2",
"versionType": "git"
},
{
"status": "affected",
"version": "7dbd8f4cabd96db5a50513de9d83a8105a5ffc81",
"lessThan": "5298c96bf0068f3160969f7ddad81976d01a9b66",
"versionType": "git"
},
{
"status": "affected",
"version": "7dbd8f4cabd96db5a50513de9d83a8105a5ffc81",
"lessThan": "3070806a7bc7bb36ed04a21022c09dafcc5619f4",
"versionType": "git"
},
{
"status": "affected",
"version": "7dbd8f4cabd96db5a50513de9d83a8105a5ffc81",
"lessThan": "b263ff9b0fc5c1f371d65c4eb196b31263d039ff",
"versionType": "git"
},
{
"status": "affected",
"version": "7b416b9dac6ede26d4ca0c1a88b448b543623ff3",
"versionType": "git"
},
{
"status": "affected",
"version": "8590bc1da625dd4a589eac0fc3aa3cf4f400424d",
"versionType": "git"
},
{
"status": "affected",
"version": "a867d5b932ac4911d3f8a1e63505061b0c81f889",
"versionType": "git"
},
{
"status": "affected",
"version": "e84b4a008365b7edbd842a063ae28d040a98db25",
"versionType": "git"
},
{
"status": "affected",
"version": "e39b17143a5b5aac81f066d455e5d3a9877eb3ae",
"versionType": "git"
},
{
"status": "affected",
"version": "4f8ae1fcb0dfbb72a7678f81bf01fb7fc85c6715",
"versionType": "git"
},
{
"status": "affected",
"version": "3.2.97",
"lessThan": "3.3",
"versionType": "semver"
},
{
"status": "affected",
"version": "3.16.52",
"lessThan": "3.17",
"versionType": "semver"
},
{
"status": "affected",
"version": "4.1.46",
"lessThan": "4.2",
"versionType": "semver"
},
{
"status": "affected",
"version": "4.4.92",
"lessThan": "4.5",
"versionType": "semver"
},
{
"status": "affected",
"version": "4.9.55",
"lessThan": "4.10",
"versionType": "semver"
},
{
"status": "affected",
"version": "4.13.6",
"lessThan": "4.14",
"versionType": "semver"
}
],
"programFiles": [
"drivers/usb/gadget/udc/dummy_hcd.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "4.14"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "4.14",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.113",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.56",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.2.10",
"versionType": "semver",
"lessThanOrEqual": "7.2.*"
},
{
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"drivers/usb/gadget/udc/dummy_hcd.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2026-98765
Source reference:
/cveMetadata/cveId
Publisher severity
No explicit severity was provided.
- Event
- #48961 · Revision 1
- Added to Heist Feed
- Publisher date