CVE-2026-98696

A flaw was found in the Linux kernel's USB serial subsystem. A local user with administrative privileges could exploit this flaw to cause a Denial of Service (DoS) or memory corruption. During the unloading of a USB serial driver module, drivers are deregistered in an incorrect sequence, allowing completion handlers to access port data after it has been released, triggering a use-after-free condition.

An incorrect USB serial driver deregistration order can leave USB I/O active while serial port drivers are being unbound and their port data is released. A completion handler may then access freed port data, creating a race based use after free that can cause a kernel crash and may potentially affect confidentiality or integrity if the stale object access becomes controllable. For the CVSS the PR:H is selected because reliable triggering normally requires unloading or deregistering the kernel module through root or CAP_SYS_MODULE. AC:H reflects the timing window between an outstanding USB completion and port teardown. The issue is not network reachable. A connected USB device or a local process using the serial port may influence I/O timing, but neither normally controls module removal without additional privileges. Impact is at least a local denial of service via kernel crash and in the worst defensible case may include confidentiality or integrity impact due to the documented use after free.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.