{"id":"CVE-2026-98767","kind":"vulnerability","aliases":["CVE-2026-98767"],"related":[],"title":"Linux kernel: DWC3 USB controller IRQ storm can panic the kernel","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: dwc3: gadget: fix IRQ storm on invalid event buffer count\n\nWhen dwc3_check_event_buf() reads a GEVNTCOUNT value exceeding the\nevent buffer length, commit 63ccd26cd1f6 (\"usb: dwc3: gadget: check\nthat event count does not exceed event buffer length\") returns IRQ_NONE\nwithout writing back GEVNTCOUNT. Since the DWC3 interrupt is\nlevel-triggered, the uncleared IRQ source keeps the line asserted,\ncausing a tight IRQ storm that accumulates 99,900 unhandled interrupts\nand triggers spurious.c:184 BUG -> kernel panic.\n\nThe resulting call stack:\n  __report_bad_irq+0xac/0xc8\n  note_interrupt+0x340/0x468\n  handle_irq_event+0xac/0xc0\n  handle_fasteoi_irq+0x120/0x228\n  gic_handle_irq+0x68/0x108\n  ...\n  kernel BUG at kernel/irq/spurious.c:184\n\nTo reproduce, write a bogus value exceeding the event buffer length\ndirectly to the GEVNTCOUNT register:\n\n  devmem <DWC3_BASE + 0xc40c> 4 0x1004\n\nWrite the bogus count back to GEVNTCOUNT to clear the IRQ source,\nconsistent with the stale event clearing pattern in\ndwc3_event_buffers_setup(), and schedule error recovery to\nreinitialize the controller.","summary":"In the Linux kernel's DWC3 USB gadget driver, a GEVNTCOUNT value larger than the event buffer makes the handler return without clearing the interrupt, so the level-triggered line keeps firing until the kernel panics. The sources describe a local-register write reproducer (devmem to GEVNTCOUNT), so the realistic impact is a denial of service.","severity":"low","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["arm","embedded","infrastructure","linux-kernel","usb-gadget"],"not_affected_if":["no-dwc3-controller","x86-server"],"how_to_check":"- `uname -r` to see the running kernel version, then compare it against the fixed kernel in the NVD entry for CVE-2026-98767\n- Check whether the DWC3 controller is present with `lsmod | grep dwc3` or `dmesg | grep -i dwc3`\n- Only systems with a DWC3 USB controller (common on some ARM SoCs) are relevant; x86 servers usually are not","fix":"- Update the Linux kernel to a release that includes the upstream fix for the dwc3 gadget IRQ storm (fixed version: unknown from sources)\n- Use the distribution's kernel package once it carries the backport","status":"open","published_at":"2026-10-18T16:17:30+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","triaged_at":"2026-10-25T05:16:42+00:00","updated_at":"2026-10-25T05:16:42+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-25T05:16:42Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream fix for the dwc3 gadget IRQ storm (fixed version: unknown from sources)\n- Use the distribution's kernel package once it carries the backport","reach":"local","title":"Linux kernel: DWC3 USB controller IRQ storm can panic the kernel","impact":"low","summary":"In the Linux kernel's DWC3 USB gadget driver, a GEVNTCOUNT value larger than the event buffer makes the handler return without clearing the interrupt, so the level-triggered line keeps firing until the kernel panics. The sources describe a local-register write reproducer (devmem to GEVNTCOUNT), so the realistic impact is a denial of service.","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","arm","embedded","usb-gadget"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Kernel panic from an interrupt storm, causing a denial of service","analyst_note":"Confirm the fixed kernel version and affected stable branches from the NVD entry or the kernel.org stable commit for the dwc3 gadget fix.","how_to_check":"- `uname -r` to see the running kernel version, then compare it against the fixed kernel in the NVD entry for CVE-2026-98767\n- Check whether the DWC3 controller is present with `lsmod | grep dwc3` or `dmesg | grep -i dwc3`\n- Only systems with a DWC3 USB controller (common on some ARM SoCs) are relevant; x86 servers usually are not","needs_analyst":true,"not_affected_if":["no-dwc3-controller","x86-server"],"who_is_affected":"Only systems that run a kernel with the commit 63ccd26cd1f6 and use a DWC3 USB controller are exposed, which mostly means embedded boards, ARM SoCs and some development hardware. Standard x86 servers and cloud VMs without a DWC3 controller are not affected, and the sources do not say which kernel versions carry the bug beyond that commit.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.00075,"input_tokens":3752,"output_tokens":750,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'+0':183C,187C,192C,197C,202C '-2026':13A,16A '-98767':14A,17A '0x1004':230C '0xc40c':228C '184':172C,208C '4':229C '63ccd26cd1f6':121C '900':166C '99':165C 'accumul':164C 'arm':18B 'assert':157C 'back':140C,235C 'bad':181C 'base':227C 'bogus':213C,233C 'buf':110C 'buffer':43B,104C,118C,133C,218C,253C 'bug':173C,205C 'call':178C 'caus':158C 'check':108C,125C 'clear':49B,239C,248C 'commit':120C 'consist':243C 'control':5A,262C 'count':105C,128C,234C 'cve':12A,15A 'denial':82B 'describ':66B 'devmem':73B,225C 'direct':220C 'driver':35B 'dwc3':3A,32B,96C,107C,123C,144C,226C,251C 'embed':19B 'error':257C 'event':42B,103C,109C,117C,127C,132C,191C,217C,247C,252C 'exceed':115C,131C,215C 'fasteoi':195C 'fire':59B 'fix':98C 'follow':90C 'gadget':26B,34B,97C,124C 'gevntcount':37B,75B,113C,141C,223C,237C 'gic':199C 'handl':189C,194C,200C 'handler':46B 'impact':79B 'infrastructur':20B 'interrupt':51B,145C,168C,186C 'invalid':102C 'irq':6A,99C,136C,152C,161C,182C,190C,196C,201C,241C 'keep':58B,154C 'kernel':2A,11A,23B,30B,62B,88C,174C,204C 'kernel/irq/spurious.c':207C 'larger':39B 'length':119C,134C,219C 'level':55B,148C 'level-trigg':54B,147C 'line':57B,156C 'linux':1A,22B,29B,87C 'linux-kernel':21B 'local':69B 'local-regist':68B 'make':44B 'none':137C 'note':185C 'panic':9A,63B,175C 'pattern':249C 'read':111C 'realist':78B 'recoveri':258C 'regist':70B,224C 'reiniti':260C 'report':180C 'reproduc':72B,210C 'resolv':94C 'result':177C 'return':47B,135C 'schedul':256C 'servic':84B 'setup':254C 'sinc':142C 'sourc':65B,153C,242C 'spurious.c':171C 'stack':179C 'stale':246C 'storm':7A,100C,162C 'tight':160C 'trigger':56B,149C,170C 'unclear':151C 'unhandl':167C 'usb':4A,25B,33B,95C,122C 'usb-gadget':24B 'valu':38B,114C,214C 'vulner':91C 'without':48B,138C 'write':71B,139C,211C,231C 'x120/0x228':198C 'x340/0x468':188C 'x68/0x108':203C 'xac/0xc0':193C 'xac/0xc8':184C","nicknames":[],"mitigations":[],"who_affected":"Only systems that run a kernel with the commit 63ccd26cd1f6 and use a DWC3 USB controller are exposed, which mostly means embedded boards, ARM SoCs and some development hardware. Standard x86 servers and cloud VMs without a DWC3 controller are not affected, and the sources do not say which kernel versions carry the bug beyond that commit.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:30+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98767","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98767","severity":null,"published_at":"2026-10-18T16:17:30+00:00","modified_at":"2026-10-21T13:21:44+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}