EUVD-2026-103858

In the Linux kernel, the following vulnerability has been resolved: USB: cdc-acm: skip URB restart in portshutdown if disconnected acmportshutdown is called from the tty-port machinery whenever the last user closes the port. acmdisconnect sets acm-disconnected and calls ttyportttyvhangup, which...

CVE-2026-98773

The Linux kernel contains a vulnerability in the cdc-acm driver where acm_port_shutdown() unconditionally calls acm_unpoison_urbs(). When the ALWAYS_POLL_CTRL quirk is active, this causes the re-submission of control and read URBs even if the device is being disconnected. Because acm_disconnect()...

CVE-2026-98774 rust_binder: cancel deferred work items in thread exit

In the Linux kernel, the following vulnerability has been resolved: rustbinder: cancel deferred work items in thread exit If there are deferred work items on the thread todo list, then they are not cleaned up in the Thread::release method. Thus, update the code to clean up the work items even if...

CVE-2026-98773 USB: cdc-acm: skip URB restart in port_shutdown if disconnected

In the Linux kernel, the following vulnerability has been resolved: USB: cdc-acm: skip URB restart in portshutdown if disconnected acmportshutdown is called from the tty-port machinery whenever the last user closes the port. acmdisconnect sets acm-disconnected and calls ttyportttyvhangup, which...

CVE-2026-98772

The Linux kernel contains a use-after-free vulnerability within the USB serial driver component. The issue occurs in some multiport device drivers that access port driver data from completion handlers of shared URBs . Specifically, a completion handler can race with port tear down even if a NULL ...

EUVD-2026-103857

In the Linux kernel, the following vulnerability has been resolved: USB: serial: fix port tear down use-after-free Some drivers for multiport devices access port driver data from completion handlers of shared URBs submitted at attach or first open and stopped at disconnect or last close,...

CVE-2026-98772 USB: serial: fix port tear down use-after-free

In the Linux kernel, the following vulnerability has been resolved: USB: serial: fix port tear down use-after-free Some drivers for multiport devices access port driver data from completion handlers of shared URBs submitted at attach or first open and stopped at disconnect or last close,...

EUVD-2026-103856

In the Linux kernel, the following vulnerability has been resolved: usb: storage: sierrams: reject short SWoC info transfers sierragetswocinfo requests sizeofstruct swocinfo 60 bytes from the device via usbcontrolmsg, but its callers only treat a negative return value as failure. A device that...

CVE-2026-98771

A vulnerability in the Linux kernel 's usb: storage: sierra_ms driver allows an unprivileged user to disclose up to 5 bytes of stale kernel heap memory . The issue stems from sierra_get_swoc_info() failing to validate that a full 60-byte swoc_info structure was received via usb_control_msg(). Whe...

CVE-2026-98771 usb: storage: sierra_ms: reject short SWoC info transfers

In the Linux kernel, the following vulnerability has been resolved: usb: storage: sierrams: reject short SWoC info transfers sierragetswocinfo requests sizeofstruct swocinfo 60 bytes from the device via usbcontrolmsg, but its callers only treat a negative return value as failure. A device that...

CVE-2026-98770

The Linux kernel contains a vulnerability in the usb gadget midi2 component. Specifically, the jack_ins and jack_outs descriptor arrays in struct f_midi2_usb_config were incorrectly sized to MAX_CABLES. Because entries are added from both inputs and outputs during loop cycles, the arrays actually...

EUVD-2026-103855

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: midi2: Fix the jack descriptor array sizes The jack in/out descriptor arrays in struct fmidi2usbconfig have the size of MAXCABLES, which look reasonable -- but it turned out to be incorrect. Namely, the entries for...

CVE-2026-98770 usb: gadget: midi2: Fix the jack descriptor array sizes

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: midi2: Fix the jack descriptor array sizes The jack in/out descriptor arrays in struct fmidi2usbconfig have the size of MAXCABLES, which look reasonable -- but it turned out to be incorrect. Namely, the entries for...

CVE-2026-98769

The Linux kernel contains an out-of-bounds access vulnerability in the usb: gadget: f_uac1_legacy component. The functions generic_set_cmd() and generic_get_cmd() incorrectly use the low nibble of ctrl->bRequest as an index into the con->data[] array. Because struct usb_audio_control define...

EUVD-2026-103854

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fuac1legacy: validate bRequest index in genericset,getcmd genericsetcmd and genericgetcmd use the low nibble of ctrl-bRequest as an index into con-data: u8 cmd = ctrl-bRequest & 0x0F; / 0 .. 15 / ... con-datacmd =...

CVE-2026-98769 usb: gadget: f_uac1_legacy: validate bRequest index in generic_{set,get}_cmd

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fuac1legacy: validate bRequest index in genericset,getcmd genericsetcmd and genericgetcmd use the low nibble of ctrl-bRequest as an index into con-data: u8 cmd = ctrl-bRequest & 0x0F; / 0 .. 15 / ... con-datacmd =...

CVE-2026-98768

A vulnerability in the Linux kernel 's usb: typec: anx7411 driver was identified where a devm-managed IRQ could still queue work to a workqueue while the remove() function was tearing the queue down. The fix requires disabling the IRQ before destroying the workqueue. No specific exploit informati...

EUVD-2026-103853

In the Linux kernel, the following vulnerability has been resolved: usb: typec: anx7411 - stop the IRQ before destroying the workqueue The IRQ is devm-managed, so it can still queue plat-work while remove is tearing the queue down. Disable it first...

CVE-2026-98768 usb: typec: anx7411 - stop the IRQ before destroying the workqueue

In the Linux kernel, the following vulnerability has been resolved: usb: typec: anx7411 - stop the IRQ before destroying the workqueue The IRQ is devm-managed, so it can still queue plat-work while remove is tearing the queue down. Disable it first...

CVE-2026-98767

A vulnerability exists in the Linux kernel 's dwc3 gadget driver. When the dwc3_check_event_buf() function reads a GEVNTCOUNT value exceeding the event buffer length, it returns IRQ_NONE without writing back the count. Because the DWC3 interrupt is level-triggered, the uncleared source keeps the ...