{"id":"CVE-2026-98772","kind":"vulnerability","aliases":["CVE-2026-98772"],"related":[],"title":"Linux kernel USB serial: port teardown lets completion handlers use freed memory","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: serial: fix port tear down use-after-free\n\nSome drivers for multiport devices access port driver data from\ncompletion handlers of shared URBs submitted at attach() or first open()\nand stopped at disconnect() or last close(), respectively.\n\nA simple NULL check before accessing the driver data makes sure that a\nport state container has at least been allocated, but a completion\nhandler can still race with port tear down.\n\nReorder the disconnect handling so that ports are not deregistered (and\ntheir driver data freed) until after all ports have been hung up and the\ndriver disconnect() callback has run so that all I/O has been stopped.","summary":"In the Linux kernel USB serial core, port driver data could be freed while shared URB completion handlers still accessed it during disconnect or last close. A local or device-triggered race can cause a use-after-free, which may crash the kernel or be leveraged further.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","kernel","linux","usb-serial"],"not_affected_if":["no-usb-serial-devices","usb-serial-driver-not-loaded"],"how_to_check":"- `uname -r` and compare against the fixed kernel builds in the upstream stable tree (unknown from the sources)\n- `lsmod | grep -i usbserial` to see whether the USB serial driver is loaded\n- unknown whether specific multiport USB serial drivers are required from the sources","fix":"- Update the Linux kernel to a release that includes the upstream commit fixing USB serial port tear down (exact version unknown from the sources)\n- Use your distribution's kernel update channel and reboot after installing","status":"open","published_at":"2026-10-18T16:17:31+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","triaged_at":"2026-10-25T05:15:31+00:00","updated_at":"2026-10-25T05:15:31+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-10-25T05:15:31Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream commit fixing USB serial port tear down (exact version unknown from the sources)\n- Use your distribution's kernel update channel and reboot after installing","reach":"local","title":"Linux kernel USB serial: port teardown lets completion handlers use freed memory","impact":"medium","summary":"In the Linux kernel USB serial core, port driver data could be freed while shared URB completion handlers still accessed it during disconnect or last close. A local or device-triggered race can cause a use-after-free, which may crash the kernel or be leveraged further.","category":"infrastructure","nicknames":[],"who_cares":["linux","kernel","usb-serial"],"confidence":0.4,"needs_auth":"unknown","worst_case":"kernel memory corruption or crash from use-after-free during USB port teardown","analyst_note":"Check the NVD entry and the upstream kernel stable commit for affected and fixed versions, and whether an attacker can trigger it remotely or only via a physical USB device.","how_to_check":"- `uname -r` and compare against the fixed kernel builds in the upstream stable tree (unknown from the sources)\n- `lsmod | grep -i usbserial` to see whether the USB serial driver is loaded\n- unknown whether specific multiport USB serial drivers are required from the sources","needs_analyst":true,"not_affected_if":["no-usb-serial-devices","usb-serial-driver-not-loaded"],"who_is_affected":"Systems running a Linux kernel with USB serial drivers for multiport devices are the ones in scope, since the flaw is in the shared URB teardown path of those drivers. Machines without USB serial hardware or drivers loaded are unlikely to be exposed. The sources do not state the trigger conditions or who can reach it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000674,"input_tokens":3431,"output_tokens":661,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-98772':15A,18A 'access':44B,98C,127C 'alloc':142C 'attach':110C 'callback':181C 'caus':59B 'check':125C 'close':50B,120C 'complet':8A,41B,103C,145C 'contain':137C 'core':31B 'could':35B 'crash':67B 'cve':13A,16A 'data':34B,101C,130C,167C 'deregist':163C 'devic':55B,97C 'device-trigg':54B 'disconnect':47B,117C,156C,180C 'driver':33B,94C,100C,129C,166C,179C 'first':112C 'fix':85C 'follow':78C 'free':64B,92C 'freed':11A,37B,168C 'handl':157C 'handler':9A,42B,104C,146C 'hung':175C 'i/o':187C 'infrastructur':19B 'kernel':2A,20B,28B,69B,76C 'last':49B,119C 'least':140C 'let':7A 'leverag':72B 'linux':1A,21B,27B,75C 'local':52B 'make':131C 'may':66B 'memori':12A 'multiport':96C 'null':124C 'open':113C 'port':5A,32B,86C,99C,135C,151C,160C,172C 'race':57B,149C 'reorder':154C 'resolv':82C 'respect':121C 'run':183C 'serial':4A,24B,30B,84C 'share':39B,106C 'simpl':123C 'state':136C 'still':43B,148C 'stop':115C,190C 'submit':108C 'sure':132C 'tear':87C,152C 'teardown':6A 'trigger':56B 'urb':40B,107C 'usb':3A,23B,29B,83C 'usb-seri':22B 'use':10A,62B,90C 'use-after-fre':61B,89C 'vulner':79C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with USB serial drivers for multiport devices are the ones in scope, since the flaw is in the shared URB teardown path of those drivers. Machines without USB serial hardware or drivers loaded are unlikely to be exposed. The sources do not state the trigger conditions or who can reach it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:31+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98772","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98772","severity":null,"published_at":"2026-10-18T16:17:31+00:00","modified_at":"2026-10-21T13:21:45+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}