---
id: "CVE-2026-98762"
kind: "vulnerability"
aliases: ["CVE-2026-98762"]
title: "Linux kernel: DWC2 USB wakeup timer can fire after host state is freed"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["embedded", "infrastructure", "linux-kernel", "usb-host"]
not_affected_if: ["dwc2-not-loaded", "no-dwc2-hardware"]
published_at: "2026-10-18T16:17:30+00:00"
first_seen_at: "2026-10-23T21:57:16+00:00"
updated_at: "2026-10-25T05:16:45+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98762", "first_seen_at": "2026-10-23T21:57:16+00:00"}]
---

# Linux kernel: DWC2 USB wakeup timer can fire after host state is freed

In the Linux kernel's DWC2 USB host driver, a wakeup timer could be rearmed or run after the host state it uses had already been freed. The sources do not state what an attacker gains from this, so the exploitable impact is unknown.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- unknown

## Fix

- Update to a Linux kernel release that includes the upstream commit resolving this DWC2 fix (the sources do not name a version)

## Timeline

- 2026-10-23T21:57:16+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-98762

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

USB: dwc2: shut down wakeup timer before freeing HCD state

dwc2_wakeup_detected() accesses the DWC2 host state and can rearm the
wakeup timer.  dwc2_hcd_free() currently deletes the timer only after
freeing host-owned state, and timer_delete() does not synchronize a
callback or prevent it from being queued again.

Stop and shut down the timer in dwc2_hcd_release(), before the HCD
resources are freed.  This covers both the HCD initialization error path
and normal HCD removal.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_