FKIE_CVE-2026-98765

Vulnerability from fkie_nvd - Published: 2026-10-18 16:17 - Updated: 2026-10-30 13:21
Severity
Summary
In the Linux kernel, the following vulnerability has been resolved: USB: gadget: dummy-hcd: Fix wait for outstanding request completions The dummy-hcd driver emulates synchronize_irq() by waiting until its private callback_usage counter drops to 0 (with the private lock not held). This counter is incremented whenever a gadget driver callback occurs (which requires the private lock to be dropped), but not when a request completion handler is called. This is an oversight. Request completion is triggered by timer interrupts (emulating device IRQs in a real UDC), and the interrupt handlers are supposed to have completed when the synchronize_irq() emulation routine returns -- they aren't supposed to be in the middle of a completion callback. If this happens it can lead to a gadget driver's unbind routine running before all outstanding request completions have finished, maybe even allowing the gadget driver's module to be unloaded while a completion handler is still running. Fix the oversight by incrementing the callback_usage value across request completion callbacks.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/3070806a7bc7bb36ed04a21022c09dafcc5619f4
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/32721319e89a2be610b0518b88f0d188ce878063
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/48ef54100ceffbd1a055f193873574c45f408eb5
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/5298c96bf0068f3160969f7ddad81976d01a9b66
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/6849e51b89de5b6fc7447dc8e612b58df19c7dea
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/7ce4dca0d53b1c3cb2b7e7bb2e42bf5db860caf2
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/b263ff9b0fc5c1f371d65c4eb196b31263d039ff
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/d77cc7c0d739fb17413714c5c4914bd396502e20
Impacted products
Vendor Product Version
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/gadget/udc/dummy_hcd.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "32721319e89a2be610b0518b88f0d188ce878063",
              "status": "affected",
              "version": "7dbd8f4cabd96db5a50513de9d83a8105a5ffc81",
              "versionType": "git"
            },
            {
              "lessThan": "48ef54100ceffbd1a055f193873574c45f408eb5",
              "status": "affected",
              "version": "7dbd8f4cabd96db5a50513de9d83a8105a5ffc81",
              "versionType": "git"
            },
            {
              "lessThan": "d77cc7c0d739fb17413714c5c4914bd396502e20",
              "status": "affected",
              "version": "7dbd8f4cabd96db5a50513de9d83a8105a5ffc81",
              "versionType": "git"
            },
            {
              "lessThan": "6849e51b89de5b6fc7447dc8e612b58df19c7dea",
              "status": "affected",
              "version": "7dbd8f4cabd96db5a50513de9d83a8105a5ffc81",
              "versionType": "git"
            },
            {
              "lessThan": "7ce4dca0d53b1c3cb2b7e7bb2e42bf5db860caf2",
              "status": "affected",
              "version": "7dbd8f4cabd96db5a50513de9d83a8105a5ffc81",
              "versionType": "git"
            },
            {
              "lessThan": "5298c96bf0068f3160969f7ddad81976d01a9b66",
              "status": "affected",
              "version": "7dbd8f4cabd96db5a50513de9d83a8105a5ffc81",
              "versionType": "git"
            },
            {
              "lessThan": "3070806a7bc7bb36ed04a21022c09dafcc5619f4",
              "status": "affected",
              "version": "7dbd8f4cabd96db5a50513de9d83a8105a5ffc81",
              "versionType": "git"
            },
            {
              "lessThan": "b263ff9b0fc5c1f371d65c4eb196b31263d039ff",
              "status": "affected",
              "version": "7dbd8f4cabd96db5a50513de9d83a8105a5ffc81",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "7b416b9dac6ede26d4ca0c1a88b448b543623ff3",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "8590bc1da625dd4a589eac0fc3aa3cf4f400424d",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "a867d5b932ac4911d3f8a1e63505061b0c81f889",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "e84b4a008365b7edbd842a063ae28d040a98db25",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "e39b17143a5b5aac81f066d455e5d3a9877eb3ae",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "4f8ae1fcb0dfbb72a7678f81bf01fb7fc85c6715",
              "versionType": "git"
            },
            {
              "lessThan": "3.3",
              "status": "affected",
              "version": "3.2.97",
              "versionType": "semver"
            },
            {
              "lessThan": "3.17",
              "status": "affected",
              "version": "3.16.52",
              "versionType": "semver"
            },
            {
              "lessThan": "4.2",
              "status": "affected",
              "version": "4.1.46",
              "versionType": "semver"
            },
            {
              "lessThan": "4.5",
              "status": "affected",
              "version": "4.4.92",
              "versionType": "semver"
            },
            {
              "lessThan": "4.10",
              "status": "affected",
              "version": "4.9.55",
              "versionType": "semver"
            },
            {
              "lessThan": "4.14",
              "status": "affected",
              "version": "4.13.6",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/gadget/udc/dummy_hcd.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.14"
            },
            {
              "lessThan": "4.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.273",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.224",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.191",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.160",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.113",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.56",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: gadget: dummy-hcd: Fix wait for outstanding request completions\n\nThe dummy-hcd driver emulates synchronize_irq() by waiting until its\nprivate callback_usage counter drops to 0 (with the private lock not\nheld).  This counter is incremented whenever a gadget driver callback\noccurs (which requires the private lock to be dropped), but not when a\nrequest completion handler is called.\n\nThis is an oversight.  Request completion is triggered by timer\ninterrupts (emulating device IRQs in a real UDC), and the interrupt\nhandlers are supposed to have completed when the synchronize_irq()\nemulation routine returns -- they aren\u0027t supposed to be in the middle\nof a completion callback.  If this happens it can lead to a gadget\ndriver\u0027s unbind routine running before all outstanding request\ncompletions have finished, maybe even allowing the gadget driver\u0027s\nmodule to be unloaded while a completion handler is still running.\n\nFix the oversight by incrementing the callback_usage value across\nrequest completion callbacks."
    }
  ],
  "id": "CVE-2026-98765",
  "lastModified": "2026-10-30T13:21:26.047",
  "metrics": {},
  "published": "2026-10-18T16:17:30.323",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/3070806a7bc7bb36ed04a21022c09dafcc5619f4"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/32721319e89a2be610b0518b88f0d188ce878063"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/48ef54100ceffbd1a055f193873574c45f408eb5"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/5298c96bf0068f3160969f7ddad81976d01a9b66"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/6849e51b89de5b6fc7447dc8e612b58df19c7dea"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/7ce4dca0d53b1c3cb2b7e7bb2e42bf5db860caf2"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/b263ff9b0fc5c1f371d65c4eb196b31263d039ff"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/d77cc7c0d739fb17413714c5c4914bd396502e20"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Received"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.