{"id":"CVE-2026-98773","kind":"vulnerability","aliases":["CVE-2026-98773"],"related":[],"title":"Linux kernel USB cdc-acm: use-after-free when a modem is unplugged","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: cdc-acm: skip URB restart in port_shutdown if disconnected\n\nacm_port_shutdown() is called from the tty-port machinery whenever the\nlast user closes the port.  acm_disconnect() sets acm->disconnected and\ncalls tty_port_tty_vhangup(), which eventually triggers port_shutdown().\nAt that point acm_disconnect() has already called acm_poison_urbs() and\nis about to free the control and read URBs.\n\nHowever, acm_port_shutdown() unconditionally calls acm_unpoison_urbs()\nand, when the ALWAYS_POLL_CTRL quirk is set, immediately re-submits the\nctrlurb and all read URBs.  If the concurrent acm_disconnect() then\nfrees those URBs and their DMA buffers while they are in-flight, the\nresult is a use-after-free in acm_ctrl_irq() or acm_read_bulk_callback()\naccessing the freed DMA memory.\n\nFix by checking acm->disconnected after draining the delayed anchor and\nreturning early: if we are in a disconnect path the URBs must remain\npoisoned and must not be resubmitted.\n\nThe early return is placed after the delayed-anchor drain loop because\nthat loop only cancels write-side accounting (wb->use = false and\nautopm counter) and does not touch the hardware path.","summary":"A race in the Linux kernel's USB CDC ACM serial driver lets the port shutdown path resubmit URBs while a disconnect is freeing them. The sources describe a use-after-free in the control and read callbacks that touch freed DMA memory.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cdc-acm","infrastructure","linux-kernel","usb-serial"],"not_affected_if":["no-cdc-acm-devices"],"how_to_check":"- unknown","fix":"- unknown","status":"open","published_at":"2026-10-18T16:17:31+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","triaged_at":"2026-10-25T05:15:29+00:00","updated_at":"2026-10-25T05:15:29+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-25T05:15:29Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"local","title":"Linux kernel USB cdc-acm: use-after-free when a modem is unplugged","impact":"high","summary":"A race in the Linux kernel's USB CDC ACM serial driver lets the port shutdown path resubmit URBs while a disconnect is freeing them. The sources describe a use-after-free in the control and read callbacks that touch freed DMA memory.","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","usb-serial","cdc-acm"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Kernel memory corruption from freed DMA buffers; code execution not confirmed","analyst_note":"Check the upstream kernel commit and stable backports for affected and fixed versions, and whether a physical device must be attached to trigger it.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["no-cdc-acm-devices"],"who_is_affected":"Systems running a Linux kernel that includes this change and using USB CDC ACM serial devices such as modems or some USB serial adapters. The sources do not say which kernel versions are fixed or affected, or whether a plain desktop without such devices is exposed.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000602,"input_tokens":3682,"output_tokens":468,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':17A,20A '-98773':18A,21A 'access':217C 'account':272C 'acm':6A,24B,41B,89C,98C,116C,119C,135C,140C,154C,159C,184C,209C,213C,225C 'alreadi':138C 'alway':165C 'anchor':231C,261C 'autopm':277C 'buffer':193C 'bulk':215C 'call':102C,122C,139C,158C 'callback':70B,216C 'cancel':268C 'cdc':5A,23B,40B,88C 'cdc-acm':4A,22B,87C 'check':224C 'close':113C 'concurr':183C 'control':67B,149C 'counter':278C 'ctrl':167C,210C 'ctrlurb':176C 'cve':16A,19A 'delay':230C,260C 'delayed-anchor':259C 'describ':59B 'disconnect':53B,97C,117C,120C,136C,185C,226C,240C 'dma':74B,192C,220C 'drain':228C,262C 'driver':43B 'earli':234C,253C 'eventu':128C 'fals':275C 'fix':222C 'flight':199C 'follow':81C 'free':10A,55B,64B,147C,187C,207C 'freed':73B,219C 'hardwar':284C 'howev':153C 'immedi':171C 'in-flight':197C 'infrastructur':25B 'irq':211C 'kernel':2A,28B,37B,79C 'last':111C 'let':44B 'linux':1A,27B,36B,78C 'linux-kernel':26B 'loop':263C,266C 'machineri':108C 'memori':75B,221C 'modem':13A 'must':244C,248C 'path':48B,241C,285C 'place':256C 'point':134C 'poison':141C,246C 'poll':166C 'port':46B,94C,99C,107C,115C,124C,130C,155C 'quirk':168C 'race':33B 're':173C 're-submit':172C 'read':69B,151C,179C,214C 'remain':245C 'resolv':85C 'restart':92C 'resubmit':49B,251C 'result':201C 'return':233C,254C 'serial':31B,42B 'set':118C,170C 'shutdown':47B,95C,100C,131C,156C 'side':271C 'skip':90C 'sourc':58B 'submit':174C 'touch':72B,282C 'trigger':129C 'tti':106C,123C,125C 'tty-port':105C 'uncondit':157C 'unplug':15A 'unpoison':160C 'urb':50B,91C,142C,152C,161C,180C,189C,243C 'usb':3A,30B,39B,86C 'usb-seri':29B 'use':8A,62B,205C,274C 'use-after-fre':7A,61B,204C 'user':112C 'vhangup':126C 'vulner':82C 'wb':273C 'whenev':109C 'write':270C 'write-sid':269C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel that includes this change and using USB CDC ACM serial devices such as modems or some USB serial adapters. The sources do not say which kernel versions are fixed or affected, or whether a plain desktop without such devices is exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:31+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98773","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98773","severity":null,"published_at":"2026-10-18T16:17:31+00:00","modified_at":"2026-10-21T13:21:45+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}