{"id":"CVE-2026-98696","kind":"vulnerability","aliases":["CVE-2026-98696"],"related":[],"title":"Linux kernel: USB serial driver unload order causes use-after-free","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: serial: fix driver deregistration order\n\nUSB serial driver modules register one driver for the USB bus and one or\nmore drivers for the ports on the USB serial bus.\n\nWhen unloading a driver module, the USB driver must be deregistered\nbefore the USB serial bus drivers so that I/O is stopped before\nunbinding the ports to avoid use-after-free in completion handlers\naccessing port data.\n\nNote that the \"new_id\" attributes must first be removed to prevent new\nids from being added and triggering a probe of the USB driver after it\nhas been deregistered.","summary":"Unloading a USB serial driver module deregisters the port drivers before the USB driver, so I/O can still run against freed port data. The sources do not say what an attacker gains beyond a crash or memory corruption.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","kernel","linux","self-hosted","usb-serial"],"not_affected_if":["no-usb-serial-modules"],"how_to_check":"- `uname -r` to see the running kernel version\n- `lsmod | grep -i usbserial` to see whether USB serial driver modules are loaded\n- unknown for a definitive check against a fixed kernel version","fix":"- Update to a Linux kernel build that includes the upstream commit fixing USB serial driver deregistration order (version unknown from the sources)\n- Check your distribution's kernel advisory for the patched package","status":"open","published_at":"2026-10-18T16:17:23+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","triaged_at":"2026-10-25T05:19:00+00:00","updated_at":"2026-10-25T05:19:00+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-25T05:19:00Z","model":"claude-haiku-5-5","output":{"fix":"- Update to a Linux kernel build that includes the upstream commit fixing USB serial driver deregistration order (version unknown from the sources)\n- Check your distribution's kernel advisory for the patched package","reach":"local","title":"Linux kernel: USB serial driver unload order causes use-after-free","impact":"medium","summary":"Unloading a USB serial driver module deregisters the port drivers before the USB driver, so I/O can still run against freed port data. The sources do not say what an attacker gains beyond a crash or memory corruption.","category":"infrastructure","nicknames":[],"who_cares":["linux","kernel","usb-serial","self-hosted"],"confidence":0.5,"needs_auth":"unknown","worst_case":"unknown; sources describe a use-after-free during driver unload","analyst_note":"Check the upstream kernel commit and NVD entry for the fixed versions and the real impact of the use-after-free.","how_to_check":"- `uname -r` to see the running kernel version\n- `lsmod | grep -i usbserial` to see whether USB serial driver modules are loaded\n- unknown for a definitive check against a fixed kernel version","needs_analyst":true,"not_affected_if":["no-usb-serial-modules"],"who_is_affected":"Systems running Linux kernels with USB serial drivers (USB-to-serial adapters) that can have those modules unloaded. The sources do not describe a specific trigger or configuration beyond module unload. Systems without USB serial hardware or modules are likely unaffected, but the sources do not confirm this.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.00063,"input_tokens":3415,"output_tokens":576,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-98696':15A,18A 'access':141C 'add':160C 'attack':58B 'attribut':149C 'avoid':133C 'beyond':60B 'bus':92C,105C,121C 'caus':8A 'complet':139C 'corrupt':65B 'crash':62B 'cve':13A,16A 'data':50B,143C 'deregist':34B,116C,173C 'deregistr':80C 'driver':5A,32B,37B,41B,79C,84C,88C,97C,109C,113C,122C,168C 'first':151C 'fix':78C 'follow':71C 'free':12A,137C 'freed':48B 'gain':59B 'handler':140C 'host':24B 'i/o':43B,125C 'id':148C,157C 'infrastructur':19B 'kernel':2A,20B,69C 'linux':1A,21B,68C 'memori':64B 'modul':33B,85C,110C 'must':114C,150C 'new':147C,156C 'note':144C 'one':87C,94C 'order':7A,81C 'port':36B,49B,100C,131C,142C 'prevent':155C 'probe':164C 'regist':86C 'remov':153C 'resolv':75C 'run':46B 'say':55B 'self':23B 'self-host':22B 'serial':4A,27B,31B,77C,83C,104C,120C 'sourc':52B 'still':45B 'stop':127C 'trigger':162C 'unbind':129C 'unload':6A,28B,107C 'usb':3A,26B,30B,40B,76C,82C,91C,103C,112C,119C,167C 'usb-seri':25B 'use':10A,135C 'use-after-fre':9A,134C 'vulner':72C","nicknames":[],"mitigations":[],"who_affected":"Systems running Linux kernels with USB serial drivers (USB-to-serial adapters) that can have those modules unloaded. The sources do not describe a specific trigger or configuration beyond module unload. Systems without USB serial hardware or modules are likely unaffected, but the sources do not confirm this.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:23+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98696","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98696","severity":null,"published_at":"2026-10-18T16:17:23+00:00","modified_at":"2026-10-21T13:21:37+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}