{"id":"CVE-2026-98762","kind":"vulnerability","aliases":["CVE-2026-98762"],"related":[],"title":"Linux kernel: DWC2 USB wakeup timer can fire after host state is freed","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: dwc2: shut down wakeup timer before freeing HCD state\n\ndwc2_wakeup_detected() accesses the DWC2 host state and can rearm the\nwakeup timer.  dwc2_hcd_free() currently deletes the timer only after\nfreeing host-owned state, and timer_delete() does not synchronize a\ncallback or prevent it from being queued again.\n\nStop and shut down the timer in dwc2_hcd_release(), before the HCD\nresources are freed.  This covers both the HCD initialization error path\nand normal HCD removal.","summary":"In the Linux kernel's DWC2 USB host driver, a wakeup timer could be rearmed or run after the host state it uses had already been freed. The sources do not state what an attacker gains from this, so the exploitable impact is unknown.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["embedded","infrastructure","linux-kernel","usb-host"],"not_affected_if":["dwc2-not-loaded","no-dwc2-hardware"],"how_to_check":"- unknown","fix":"- Update to a Linux kernel release that includes the upstream commit resolving this DWC2 fix (the sources do not name a version)","status":"open","published_at":"2026-10-18T16:17:30+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","triaged_at":"2026-10-25T05:16:45+00:00","updated_at":"2026-10-25T05:16:45+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-10-25T05:16:45Z","model":"claude-haiku-5-5","output":{"fix":"- Update to a Linux kernel release that includes the upstream commit resolving this DWC2 fix (the sources do not name a version)","reach":"local","title":"Linux kernel: DWC2 USB wakeup timer can fire after host state is freed","impact":"low","summary":"In the Linux kernel's DWC2 USB host driver, a wakeup timer could be rearmed or run after the host state it uses had already been freed. The sources do not state what an attacker gains from this, so the exploitable impact is unknown.","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","embedded","usb-host"],"confidence":0.4,"needs_auth":"unknown","worst_case":"unknown; the sources do not describe an attacker outcome","analyst_note":"Check the NVD entry and the upstream kernel commit for the trigger, the affected kernel versions and the fixed stable release.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["no-dwc2-hardware","dwc2-not-loaded"],"who_is_affected":"Systems running a Linux kernel with the DWC2 USB host controller driver (dwc2) built in or loaded, typically embedded boards with Synopsys DesignWare USB 2.0 OTG controllers. Systems without that controller or driver are not exposed. The sources do not say what triggers the race or whether a local user or a remote device can reach it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000606,"input_tokens":3423,"output_tokens":528,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-98762':16A,19A 'access':95C 'alreadi':52B 'attack':62B 'callback':127C 'could':40B 'cover':152C 'current':109C 'cve':14A,17A 'delet':110C,122C 'detect':94C 'driver':36B 'dwc2':3A,33B,83C,92C,97C,106C,142C 'embed':20B 'error':157C 'exploit':68B 'fire':8A 'follow':77C 'free':89C,108C,115C 'freed':13A,54B,150C 'gain':63B 'hcd':90C,107C,143C,147C,155C,161C 'host':10A,27B,35B,47B,98C,117C 'host-own':116C 'impact':69B 'infrastructur':21B 'initi':156C 'kernel':2A,24B,31B,75C 'linux':1A,23B,30B,74C 'linux-kernel':22B 'normal':160C 'own':118C 'path':158C 'prevent':129C 'queu':133C 'rearm':42B,102C 'releas':144C 'remov':162C 'resolv':81C 'resourc':148C 'run':44B 'shut':84C,137C 'sourc':56B 'state':11A,48B,59B,91C,99C,119C 'stop':135C 'synchron':125C 'timer':6A,39B,87C,105C,112C,121C,140C 'unknown':71B 'usb':4A,26B,34B,82C 'usb-host':25B 'use':50B 'vulner':78C 'wakeup':5A,38B,86C,93C,104C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with the DWC2 USB host controller driver (dwc2) built in or loaded, typically embedded boards with Synopsys DesignWare USB 2.0 OTG controllers. Systems without that controller or driver are not exposed. The sources do not say what triggers the race or whether a local user or a remote device can reach it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:30+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98762","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98762","severity":null,"published_at":"2026-10-18T16:17:30+00:00","modified_at":"2026-10-21T13:21:44+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}