CVE-2026-98762 in Linux
Summary
by MITRE • 10/18/2026
In the Linux kernel, the following vulnerability has been resolved:
USB: dwc2: shut down wakeup timer before freeing HCD state
dwc2_wakeup_detected() accesses the DWC2 host state and can rearm the wakeup timer. dwc2_hcd_free() currently deletes the timer only after freeing host-owned state, and timer_delete() does not synchronize a callback or prevent it from being queued again.
Stop and shut down the timer in dwc2_hcd_release(), before the HCD resources are freed. This covers both the HCD initialization error path and normal HCD removal.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/18/2026
The Linux kernel driver for the DesignWare USB 2.0 OTG controller, known as dwc2, contains a race condition vulnerability related to timer management during host controller detachment. The core issue lies in the sequence of operations performed when freeing Host Controller Driver state resources. Specifically, the function dwc2_hcd_free() is responsible for releasing these resources but currently deletes the wakeup timer only after the host-owned state structures have already been freed. This ordering creates a critical window where hardware interrupts or asynchronous events can trigger callbacks that reference memory regions which are no longer valid.
The vulnerability manifests when the callback function dwc2_wakeup_detected() executes while the HCD state is in an inconsistent or deallocated state. This function accesses DWC2 host state data and has the capability to rearm the wakeup timer. Because standard kernel timer deletion mechanisms do not inherently synchronize with pending callbacks or prevent them from being queued again if they are already executing, there is a high risk that dwc2_wakeup_detected() will access freed memory. This constitutes a use-after-free vulnerability where the driver attempts to operate on data structures that have been released back to the system allocator.
From a technical perspective, this flaw allows for potential kernel panic or arbitrary code execution depending on how the freed memory is subsequently utilized by other subsystems. If an attacker can trigger the conditions leading to HCD removal while specific hardware states are active, they may exploit the race condition to corrupt kernel memory structures. This aligns with CWE-416, Use After Free, as the driver accesses a pointer after it has been freed. Furthermore, this scenario reflects aspects of CWE-362, Concurrent Execution using Shared Resource with Improper Synchronization, because the timer callback and the resource freeing process occur concurrently without adequate locking or ordering guarantees to prevent access to invalid memory.
The operational impact includes system instability, denial of service through kernel oops or panic, and potentially privilege escalation if the corrupted memory allows for control flow hijacking. The vulnerability affects both normal HCD removal paths and error handling during initialization, meaning it can be triggered in various lifecycle stages of the USB controller driver. This broadens the attack surface as any user with access to trigger device unplug events or specific hardware states could potentially exploit this flaw.
To mitigate this issue, the fix involves reordering the operations within dwc2_hcd_release() and related cleanup functions. The wakeup timer must be explicitly stopped and shut down before any HCD resources are freed. This ensures that no pending callbacks can execute against deallocated memory structures. By enforcing strict ordering where timer termination precedes resource release, the race condition is eliminated. System administrators should apply kernel updates that include this patch to ensure proper synchronization of hardware interrupt handling with driver state management. Regularly updating the Linux kernel and associated USB drivers is essential to maintain system integrity against such low-level concurrency bugs.