{"id":"CVE-2026-98763","kind":"vulnerability","aliases":["CVE-2026-98763"],"related":[],"title":"Linux kernel: USB core leaves a freed control endpoint pointer reachable","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: core: clear both ep_in and ep_out for non-ep0 control endpoints\n\nIn usb_enable_endpoint(), non-zero control endpoints (where\nusb_endpoint_xfer_control(&ep->desc) is true) populate both\ndev->ep_in[epnum] and dev->ep_out[epnum] with the same struct\nusb_host_endpoint pointer.\n\nHowever, usb_disable_endpoint() only clears either dev->ep_out[epnum] or\ndev->ep_in[epnum] depending on the direction bit of epaddr when\nreset_hardware is set, leaving the opposite direction's array slot\npointing to the disabled/freed endpoint.\n\nClear both dev->ep_out[epnum] and dev->ep_in[epnum] when disabling a\nnon-ep0 control endpoint with reset_hardware set, and update the\nfunction kerneldoc accordingly.\n\nTested in QEMU against Linux 7.3.0-rc3 using dummy_hcd and raw-gadget to\nenumerate a USB device with a non-zero control endpoint\n(bEndpointAddress 0x01, bmAttributes USB_ENDPOINT_XFER_CONTROL),\nverifying that both dev->ep_in[1] and dev->ep_out[1] are cleared when\nthe interface is disabled.","summary":"In the Linux kernel USB core, disabling a non-zero control endpoint clears only one direction's pointer, leaving a stale reference to a freed endpoint in the other. The sources do not describe a concrete way for an attacker to trigger it or what they gain from it.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["linux-kernel","runtime","usb"],"not_affected_if":[],"how_to_check":"- unknown","fix":"- unknown","status":"open","published_at":"2026-10-18T16:17:30+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","triaged_at":"2026-10-25T05:16:43+00:00","updated_at":"2026-10-25T05:16:43+00:00","category":"runtime","confidence":0.4,"triage":{"at":"2026-10-25T05:16:43Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"local","title":"Linux kernel: USB core leaves a freed control endpoint pointer reachable","impact":"medium","summary":"In the Linux kernel USB core, disabling a non-zero control endpoint clears only one direction's pointer, leaving a stale reference to a freed endpoint in the other. The sources do not describe a concrete way for an attacker to trigger it or what they gain from it.","category":"runtime","nicknames":[],"who_cares":["linux-kernel","usb"],"confidence":0.4,"needs_auth":"unknown","worst_case":"unknown; a stale pointer to a freed USB endpoint","analyst_note":"Check the NVD entry and the upstream kernel commit for the affected and fixed kernel versions and whether an unprivileged or physically attached device can trigger the use-after-free.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000555,"input_tokens":3676,"output_tokens":375,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-98763':14A,17A '0x01':229C '1':241C,246C '7.3.0':207C 'accord':201C 'array':166C 'attack':63B 'bendpointaddress':228C 'bit':153C 'bmattribut':230C 'clear':36B,83C,138C,173C,248C 'concret':59B 'control':8A,34B,94C,103C,109C,190C,226C,234C 'core':4A,28B,82C 'cve':12A,15A 'depend':149C 'desc':111C 'describ':57B 'dev':116C,121C,140C,145C,175C,180C,238C,243C 'devic':220C 'direct':39B,152C,164C 'disabl':29B,135C,185C,253C 'disabled/freed':171C 'dummi':210C 'either':139C 'enabl':98C 'endpoint':9A,35B,49B,95C,99C,104C,107C,131C,136C,172C,191C,227C,232C 'enumer':217C 'ep':85C,88C,110C,117C,122C,141C,146C,176C,181C,239C,244C 'ep0':93C,189C 'epaddr':155C 'epnum':119C,124C,143C,148C,178C,183C 'follow':76C 'freed':7A,48B 'function':199C 'gadget':215C 'gain':70B 'hardwar':158C,194C 'hcd':211C 'host':130C 'howev':133C 'interfac':251C 'kernel':2A,20B,26B,74C 'kerneldoc':200C 'leav':5A,42B,161C 'linux':1A,19B,25B,73C,206C 'linux-kernel':18B 'non':32B,92C,101C,188C,224C 'non-ep0':91C,187C 'non-zero':31B,100C,223C 'one':38B 'opposit':163C 'point':168C 'pointer':10A,41B,132C 'popul':114C 'qemu':204C 'raw':214C 'raw-gadget':213C 'rc3':208C 'reachabl':11A 'refer':45B 'reset':157C,193C 'resolv':80C 'runtim':21B 'set':160C,195C 'slot':167C 'sourc':54B 'stale':44B 'struct':128C 'test':202C 'trigger':65B 'true':113C 'updat':197C 'usb':3A,22B,27B,81C,97C,106C,129C,134C,219C,231C 'use':209C 'verifi':235C 'vulner':77C 'way':60B 'xfer':108C,233C 'zero':33B,102C,225C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:30+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98763","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98763","severity":null,"published_at":"2026-10-18T16:17:30+00:00","modified_at":"2026-10-21T13:21:44+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}