CVE-2026-98772 in Linux
Summary
by MITRE • 10/18/2026
In the Linux kernel, the following vulnerability has been resolved:
USB: serial: fix port tear down use-after-free
Some drivers for multiport devices access port driver data from completion handlers of shared URBs submitted at attach() or first open() and stopped at disconnect() or last close(), respectively.
A simple NULL check before accessing the driver data makes sure that a port state container has at least been allocated, but a completion handler can still race with port tear down.
Reorder the disconnect handling so that ports are not deregistered (and their driver data freed) until after all ports have been hung up and the driver disconnect() callback has run so that all I/O has been stopped.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/18/2026
The identified vulnerability in the Linux kernel represents a critical use-after-free condition within the USB serial subsystem, specifically affecting drivers for multiport devices. This flaw arises from a race condition between port teardown operations and asynchronous completion handlers associated with shared Uniform Resource Block (URB) submissions. In these complex device configurations, multiple ports share URBs that are submitted during initial attachment or first open events and are intended to be stopped upon disconnect or final close. The core issue lies in the timing of memory deallocation relative to the cessation of I/O operations. While existing code performs a NULL check before accessing driver data within completion handlers to ensure allocation, this safeguard is insufficient because it does not prevent access after the port state container has been freed but before all asynchronous activities have fully terminated.
The technical root cause involves an improper ordering in the disconnect handling logic. Previously, ports were deregistered and their associated driver data structures were immediately freed upon initiation of the disconnect process. However, completion handlers for previously submitted URBs may still execute asynchronously after this point. When these handlers attempt to access the now-freed memory region containing port state information, a use-after-free condition occurs. This race condition allows the kernel to dereference invalid pointers or read corrupted data, leading to unpredictable behavior such as system crashes, kernel panics, or potential exploitation for arbitrary code execution if an attacker can influence the contents of the freed memory through heap spraying techniques.
From a security and standards perspective, this vulnerability maps directly to CWE-416: Use After Free, which describes accessing memory after it has been released without ensuring that the access is safe. Furthermore, in the context of attack vectors, this flaw aligns with ATT&CK technique T1203: Exploitation for Defense Evasion or potentially T1059: Command and Scripting Interpreter if the crash leads to a denial-of-service state that disrupts security monitoring capabilities. The vulnerability highlights the complexity of managing shared resources in asynchronous driver models, where lifecycle management must strictly synchronize with I/O completion states rather than just logical connection states.
The operational impact of this flaw is significant for systems relying on multiport USB serial devices. A successful exploit could result in a denial-of-service condition by crashing the kernel or compromising system integrity through memory corruption. For environments requiring high availability and stability, such as industrial control systems or network infrastructure using USB-based modems or adapters, this vulnerability poses a tangible risk to service continuity. The lack of proper synchronization between port deregistration and I/O termination creates a window where malicious actors could trigger the race condition by rapidly connecting and disconnecting devices while maintaining active data streams.
To mitigate this vulnerability, the kernel developers have reordered the disconnect handling sequence within the USB serial driver framework. The fix ensures that ports are not deregistered nor their driver data freed until after all ports have been hung up and the driver's disconnect callback has fully executed. This reordering guarantees that all pending I/O operations are stopped before any memory associated with port state containers is released, thereby eliminating the race condition window. System administrators should apply kernel updates containing this patch to restore safe operation of multiport USB serial devices. Additionally, developers implementing custom drivers for similar hardware should review their disconnect logic to ensure strict ordering between stopping asynchronous transfers and freeing resource structures, adhering to best practices for memory safety in concurrent environments.