USB: cdc-acm: skip URB restart in port_shutdown if disconnected

MITRE NVD CVE.ORG JSON API

Summary

CVECVE-2026-98773
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2026-10-18 16:17:31 UTC
Updated2026-10-19 10:19:41 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: USB: cdc-acm: skip URB restart in port_shutdown if disconnected acm_port_shutdown() is called from the tty-port machinery whenever the last user closes the port. acm_disconnect() sets acm->disconnected and calls tty_port_tty_vhangup(), which eventually triggers port_shutdown(). At that point acm_disconnect() has already called acm_poison_urbs() and is about to free the control and read URBs. However, acm_port_shutdown() unconditionally calls acm_unpoison_urbs() and, when the ALWAYS_POLL_CTRL quirk is set, immediately re-submits the ctrlurb and all read URBs. If the concurrent acm_disconnect() then frees those URBs and their DMA buffers while they are in-flight, the result is a use-after-free in acm_ctrl_irq() or acm_read_bulk_callback() accessing the freed DMA memory. Fix by checking acm->disconnected after draining the delayed anchor and returning early: if we are in a disconnect path the URBs must remain poisoned and must not be resubmitted. The early return is placed after the delayed-anchor drain loop because that loop only cancels write-side accounting (wb->use = false and autopm counter) and does not touch the hardware path.

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected 603d5a7110832e10165d21f9a1486399457177de 9742905d9ed5bf23ebe4c100dec80b6bc50fb522 git Not specified
CNA Linux Linux affected 5d29d7ff8679e5a525f22da467ba33c042e8029b a0ed07b5bbb2d8fcef86810453216070691816e7 git Not specified
CNA Linux Linux affected f58752ebcb35e156c85cd1a82d6579c7af3b9023 420ca35af891d33522cc08504768ccd60a4c450a git Not specified
CNA Linux Linux affected f58752ebcb35e156c85cd1a82d6579c7af3b9023 dc614d6bc991740d41d5a99ac7765c4b675dda88 git Not specified
CNA Linux Linux affected d826061aa64cb28089bf4c73e301dd7928662b84 git Not specified
CNA Linux Linux affected 8fb82e3555a7d56a05d8ef0edee9859f889c0860 git Not specified
CNA Linux Linux affected 283f8162cc3c82086537cbc7dc01870dbeb07a91 git Not specified
CNA Linux Linux affected f77f10bc76c2da86b4248269472f6d971e37828b git Not specified
CNA Linux Linux affected 6.12.83 6.12.113 semver Not specified
CNA Linux Linux affected 6.18.24 6.18.56 semver Not specified
CNA Linux Linux affected 6.1.175 6.2 semver Not specified
CNA Linux Linux affected 6.6.136 6.7 semver Not specified
CNA Linux Linux affected 6.19.14 6.20 semver Not specified
CNA Linux Linux affected 7.0.1 7.1 semver Not specified
CNA Linux Linux affected 7.1 Not specified
CNA Linux Linux unaffected 7.1 semver Not specified
CNA Linux Linux unaffected 6.12.113 6.12.* semver Not specified
CNA Linux Linux unaffected 6.18.56 6.18.* semver Not specified
CNA Linux Linux unaffected 7.2.10 7.2.* semver Not specified
CNA Linux Linux unaffected 7.3 * original_commit_for_fix Not specified

References

ReferenceSourceLinkTags
git.kernel.org/stable/c/420ca35af891d33522cc08504768ccd60a4c450a 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/9742905d9ed5bf23ebe4c100dec80b6bc50fb522 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/dc614d6bc991740d41d5a99ac7765c4b675dda88 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/a0ed07b5bbb2d8fcef86810453216070691816e7 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report