Live › vulnerability › CVE-2026-98696
Go to dashboardUnloading a USB serial driver module deregisters the port drivers before the USB driver, so I/O can still run against freed port data. The sources do not say what an attacker gains beyond a crash or memory corruption.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Systems running Linux kernels with USB serial drivers (USB-to-serial adapters) that can have those modules unloaded. The sources do not describe a specific trigger or configuration beyond module unload. Systems without USB serial hardware or modules are likely unaffected, but the sources do not confirm this.
No product ranges from the sources yet.
uname -r to see the running kernel versionlsmod | grep -i usbserial to see whether USB serial driver modules are loadedEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
USB: serial: fix driver deregistration order
USB serial driver modules register one driver for the USB bus and one or more drivers for the ports on the USB serial bus.
When unloading a driver module, the USB driver must be deregistered before the USB serial bus drivers so that I/O is stopped before unbinding the ports to avoid use-after-free in completion handlers accessing port data.
Note that the "new_id" attributes must first be removed to prevent new ids from being added and triggering a probe of the USB driver after it has been deregistered.
This page as .md · .json · in your agent: get_signal("CVE-2026-98696")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.