CVE-2026-98762

The Linux kernel contains a vulnerability in the dwc2 USB controller driver. Specifically, the dwc2_hcd_free() function deletes the wakeup timer only after freeing host-owned state, which can lead to issues because timer_delete() does not synchronize callbacks or prevent re-queuing. This allows d...

CVE-2026-98762 USB: dwc2: shut down wakeup timer before freeing HCD state

In the Linux kernel, the following vulnerability has been resolved: USB: dwc2: shut down wakeup timer before freeing HCD state dwc2wakeupdetected accesses the DWC2 host state and can rearm the wakeup timer. dwc2hcdfree currently deletes the timer only after freeing host-owned state, and timerdele...