GHSA-84FC-MWQJ-5RJH

Vulnerability from github – Published: 2026-10-18 18:32 – Updated: 2026-10-30 15:34
VLAI
Details

In the Linux kernel, the following vulnerability has been resolved:

USB: gadget: dummy-hcd: Fix wait for outstanding request completions

The dummy-hcd driver emulates synchronize_irq() by waiting until its private callback_usage counter drops to 0 (with the private lock not held). This counter is incremented whenever a gadget driver callback occurs (which requires the private lock to be dropped), but not when a request completion handler is called.

This is an oversight. Request completion is triggered by timer interrupts (emulating device IRQs in a real UDC), and the interrupt handlers are supposed to have completed when the synchronize_irq() emulation routine returns -- they aren't supposed to be in the middle of a completion callback. If this happens it can lead to a gadget driver's unbind routine running before all outstanding request completions have finished, maybe even allowing the gadget driver's module to be unloaded while a completion handler is still running.

Fix the oversight by incrementing the callback_usage value across request completion callbacks.

Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-98765"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-10-18T16:17:30Z",
    "severity": null
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: gadget: dummy-hcd: Fix wait for outstanding request completions\n\nThe dummy-hcd driver emulates synchronize_irq() by waiting until its\nprivate callback_usage counter drops to 0 (with the private lock not\nheld).  This counter is incremented whenever a gadget driver callback\noccurs (which requires the private lock to be dropped), but not when a\nrequest completion handler is called.\n\nThis is an oversight.  Request completion is triggered by timer\ninterrupts (emulating device IRQs in a real UDC), and the interrupt\nhandlers are supposed to have completed when the synchronize_irq()\nemulation routine returns -- they aren\u0027t supposed to be in the middle\nof a completion callback.  If this happens it can lead to a gadget\ndriver\u0027s unbind routine running before all outstanding request\ncompletions have finished, maybe even allowing the gadget driver\u0027s\nmodule to be unloaded while a completion handler is still running.\n\nFix the oversight by incrementing the callback_usage value across\nrequest completion callbacks.",
  "id": "GHSA-84fc-mwqj-5rjh",
  "modified": "2026-10-30T15:34:00Z",
  "published": "2026-10-18T18:32:02Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98765"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/3070806a7bc7bb36ed04a21022c09dafcc5619f4"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/32721319e89a2be610b0518b88f0d188ce878063"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/48ef54100ceffbd1a055f193873574c45f408eb5"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/5298c96bf0068f3160969f7ddad81976d01a9b66"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/6849e51b89de5b6fc7447dc8e612b58df19c7dea"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/7ce4dca0d53b1c3cb2b7e7bb2e42bf5db860caf2"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/b263ff9b0fc5c1f371d65c4eb196b31263d039ff"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/d77cc7c0d739fb17413714c5c4914bd396502e20"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.