Live › vulnerability › CVE-2026-98762
Go to dashboardIn the Linux kernel's DWC2 USB host driver, a wakeup timer could be rearmed or run after the host state it uses had already been freed. The sources do not state what an attacker gains from this, so the exploitable impact is unknown.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Systems running a Linux kernel with the DWC2 USB host controller driver (dwc2) built in or loaded, typically embedded boards with Synopsys DesignWare USB 2.0 OTG controllers. Systems without that controller or driver are not exposed. The sources do not say what triggers the race or whether a local user or a remote device can reach it.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
USB: dwc2: shut down wakeup timer before freeing HCD state
dwc2_wakeup_detected() accesses the DWC2 host state and can rearm the wakeup timer. dwc2_hcd_free() currently deletes the timer only after freeing host-owned state, and timer_delete() does not synchronize a callback or prevent it from being queued again.
Stop and shut down the timer in dwc2_hcd_release(), before the HCD resources are freed. This covers both the HCD initialization error path and normal HCD removal.
This page as .md · .json · in your agent: get_signal("CVE-2026-98762")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.