Live › vulnerability › CVE-2026-98697
Go to dashboardA race in the Linux kernel USB serial driver lets a write to the new_id attribute add an ID after the dynamic IDs were freed, so memory can leak. The sources describe a memory leak during driver deregistration, not code execution.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Systems running a Linux kernel with the USB serial driver that includes this change are potentially affected; the sources do not name the affected kernel versions. Systems without USB serial devices or without this kernel build are unlikely to be exposed. Whether an unprivileged user can trigger the race is unknown.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
USB: serial: fix dynamic id driver deregistration race
Only free the dynamic ids after having deregistered the driver and removed the "new_id" attribute to avoid leaking any id added by a racing write to the attribute.
This page as .md · .json · in your agent: get_signal("CVE-2026-98697")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.