https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 01 Nov 2026 21:45:50 +0000 https://db.gcve.eu/vuln/cve-2026-98765 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>USB: gadget: dummy-hcd: Fix wait for outstanding request completions</p> <p>The dummy-hcd driver emulates synchronize_irq() by waiting until its private callback_usage counter drops to 0 (with the private lock not held). This counter is incremented whenever a gadget driver callback occurs (which requires the private lock to be dropped), but not when a request completion handler is called.</p> <p>This is an oversight. Request completion is triggered by timer interrupts (emulating device IRQs in a real UDC), and the interrupt handlers are supposed to have completed when the synchronize_irq() emulation routine returns -- they aren&#39;t supposed to be in the middle of a completion callback. If this happens it can lead to a gadget driver&#39;s unbind routine running before all outstanding request completions have finished, maybe even allowing the gadget driver&#39;s module to be unloaded while a completion handler is still running.</p> <p>Fix the oversight by incrementing the callback_usage value across request completion callbacks.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>USB: gadget: dummy-hcd: Fix wait for outstanding request completions</p> <p>The dummy-hcd driver emulates synchronize_irq() by waiting until its private callback_usage counter drops to 0 (with the private lock not held). This counter is incremented whenever a gadget driver callback occurs (which requires the private lock to be dropped), but not when a request completion handler is called.</p> <p>This is an oversight. Request completion is triggered by timer interrupts (emulating device IRQs in a real UDC), and the interrupt handlers are supposed to have completed when the synchronize_irq() emulation routine returns -- they aren&#39;t supposed to be in the middle of a completion callback. If this happens it can lead to a gadget driver&#39;s unbind routine running before all outstanding request completions have finished, maybe even allowing the gadget driver&#39;s module to be unloaded while a completion handler is still running.</p> <p>Fix the oversight by incrementing the callback_usage value across request completion callbacks.</p> https://db.gcve.eu/vuln/cve-2026-98765