CVE-2026-98763
kernel: usb: core: clear both ep_in and ep_out for non-ep0 control endpoints
Severity
ModerateRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · October 18, 2026
Updated · October 23, 2026
Description
A flaw was found in the Linux kernel's USB subsystem. This vulnerability allows an attacker with physical access connecting a malicious USB device, or a local user with privileges to emulate USB hardware, to cause a Denial of Service (DoS) or potentially execute arbitrary code. When disabling a bidirectional USB control endpoint, the kernel fails to clear pointers for both data directions, leading to a use-after-free condition when accessing the freed endpoint memory.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.1 · 6.2CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-825 · Expired Pointer Dereference