---
id: "CVE-2026-98767"
kind: "vulnerability"
aliases: ["CVE-2026-98767"]
title: "Linux kernel: DWC3 USB controller IRQ storm can panic the kernel"
severity: "low"
cvss: null
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["arm", "embedded", "infrastructure", "linux-kernel", "usb-gadget"]
not_affected_if: ["no-dwc3-controller", "x86-server"]
published_at: "2026-10-18T16:17:30+00:00"
first_seen_at: "2026-10-23T21:57:16+00:00"
updated_at: "2026-10-25T05:16:42+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98767", "first_seen_at": "2026-10-23T21:57:16+00:00"}]
---

# Linux kernel: DWC3 USB controller IRQ storm can panic the kernel

In the Linux kernel's DWC3 USB gadget driver, a GEVNTCOUNT value larger than the event buffer makes the handler return without clearing the interrupt, so the level-triggered line keeps firing until the kernel panics. The sources describe a local-register write reproducer (devmem to GEVNTCOUNT), so the realistic impact is a denial of service.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- `uname -r` to see the running kernel version, then compare it against the fixed kernel in the NVD entry for CVE-2026-98767
- Check whether the DWC3 controller is present with `lsmod | grep dwc3` or `dmesg | grep -i dwc3`
- Only systems with a DWC3 USB controller (common on some ARM SoCs) are relevant; x86 servers usually are not

## Fix

- Update the Linux kernel to a release that includes the upstream fix for the dwc3 gadget IRQ storm (fixed version: unknown from sources)
- Use the distribution's kernel package once it carries the backport

## Timeline

- 2026-10-23T21:57:16+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-98767

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

usb: dwc3: gadget: fix IRQ storm on invalid event buffer count

When dwc3_check_event_buf() reads a GEVNTCOUNT value exceeding the
event buffer length, commit 63ccd26cd1f6 ("usb: dwc3: gadget: check
that event count does not exceed event buffer length") returns IRQ_NONE
without writing back GEVNTCOUNT. Since the DWC3 interrupt is
level-triggered, the uncleared IRQ source keeps the line asserted,
causing a tight IRQ storm that accumulates 99,900 unhandled interrupts
and triggers spurious.c:184 BUG -> kernel panic.

The resulting call stack:
  __report_bad_irq+0xac/0xc8
  note_interrupt+0x340/0x468
  handle_irq_event+0xac/0xc0
  handle_fasteoi_irq+0x120/0x228
  gic_handle_irq+0x68/0x108
  ...
  kernel BUG at kernel/irq/spurious.c:184

To reproduce, write a bogus value exceeding the event buffer length
directly to the GEVNTCOUNT register:

  devmem <DWC3_BASE + 0xc40c> 4 0x1004

Write the bogus count back to GEVNTCOUNT to clear the IRQ source,
consistent with the stale event clearing pattern in
dwc3_event_buffers_setup(), and schedule error recovery to
reinitialize the controller.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_