CVE-2026-98773
Description
In the Linux kernel, the following vulnerability has been resolved: USB: cdc-acm: skip URB restart in port_shutdown if disconnected acm_port_shutdown() is called from the tty-port machinery whenever the last user closes the port. acm_disconnect() sets acm->disconnected and calls tty_port_tty_vhangup(), which eventually triggers port_shutdown(). At that point acm_disconnect() has already called acm_poison_urbs() and is about to free the control and read URBs. However, acm_port_shutdown() unconditionally calls acm_unpoison_urbs() and, when the ALWAYS_POLL_CTRL quirk is set, immediately re-submits the ctrlurb and all read URBs. If the concurrent acm_disconnect() then frees those URBs and their DMA buffers while they are in-flight, the result is a use-after-free in acm_ctrl_irq() or acm_read_bulk_callback() accessing the freed DMA memory. Fix by checking acm->disconnected after draining the delayed anchor and returning early: if we are in a disconnect path the URBs must remain poisoned and must not be resubmitted. The early return is placed after the delayed-anchor drain loop because that loop only cancels write-side accounting (wb->use = false and autopm counter) and does not touch the hardware path.
How to fix
- Linux Linuxd97da42e9de577dc827d4e8866e6971deefe2d9c, d86775e79838d7d2e38ccf506a7d0f8e2dd4d5d0, 9742905d9ed5bf23ebe4c100dec80b6bc50fb522, a0ed07b5bbb2d8fcef86810453216070691816e7, 420ca35af891d33522cc08504768ccd60a4c450a, dc614d6bc991740d41d5a99ac7765c4b675dda88, 6.1.191, 6.6.160, 6.12.113, 6.18.56, 6.20, 7.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | d826061aa64cb28089bf4c73e301dd7928662b84 ≤ v < d97da42e9de577dc827d4e8866e6971deefe2d9c, 8fb82e3555a7d56a05d8ef0edee9859f889c0860 ≤ v < d86775e79838d7d2e38ccf506a7d0f8e2dd4d5d0, 603d5a7110832e10165d21f9a1486399457177de ≤ v < 9742905d9ed5bf23ebe4c100dec80b6bc50fb522, 5d29d7ff8679e5a525f22da467ba33c042e8029b ≤ v < a0ed07b5bbb2d8fcef86810453216070691816e7, f58752ebcb35e156c85cd1a82d6579c7af3b9023 ≤ v < 420ca35af891d33522cc08504768ccd60a4c450a, f58752ebcb35e156c85cd1a82d6579c7af3b9023 ≤ v < dc614d6bc991740d41d5a99ac7765c4b675dda88, 283f8162cc3c82086537cbc7dc01870dbeb07a91, f77f10bc76c2da86b4248269472f6d971e37828b, 6.1.175 ≤ v < 6.1.191, 6.6.136 ≤ v < 6.6.160, 6.12.83 ≤ v < 6.12.113, 6.18.24 ≤ v < 6.18.56, 6.19.14 ≤ v < 6.20, 7.0.1 ≤ v < 7.1, 7.1 | d97da42e9de577dc827d4e8866e6971deefe2d9c, d86775e79838d7d2e38ccf506a7d0f8e2dd4d5d0, 9742905d9ed5bf23ebe4c100dec80b6bc50fb522, a0ed07b5bbb2d8fcef86810453216070691816e7, 420ca35af891d33522cc08504768ccd60a4c450a, dc614d6bc991740d41d5a99ac7765c4b675dda88, 6.1.191, 6.6.160, 6.12.113, 6.18.56, 6.20, 7.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.