CVE-2026-98765: Linux Kernel USB Gadget Race Condition

CVE-2026-98765 Overview

CVE-2026-98765 is a race condition in the Linux kernel's USB gadget dummy-hcd driver. The driver emulates synchronize_irq() by waiting until its private callback_usage counter reaches zero. The counter is incremented on gadget driver callbacks but was not incremented across request completion callbacks. This oversight allows a gadget driver's unbind routine to run while an outstanding request completion handler is still executing. In the worst case, the gadget driver module can be unloaded while a completion handler is still running, leading to use-after-free conditions in kernel memory.

Critical Impact
A race between request completion handlers and gadget driver teardown can execute code in a module after it has been unloaded, destabilizing the kernel.

Affected Products

Linux kernel USB gadget subsystem (drivers/usb/gadget/udc/dummy_hcd.c)
Multiple stable kernel branches referenced by the upstream fix commits
Systems using the dummy-hcd driver for USB gadget emulation and testing

Discovery Timeline

2026-10-18 - CVE-2026-98765 published to NVD
2026-10-21 - Last updated in NVD database

Technical Details for CVE-2026-98765

Vulnerability Analysis

The dummy-hcd driver provides a virtual USB Host Controller Driver used to emulate USB device controllers for testing gadget drivers. To coordinate with asynchronous callbacks, the driver emulates synchronize_irq() by spinning on a private counter named callback_usage while the private lock is released.

The counter was incremented when invoking gadget driver callbacks that require the lock to be dropped. It was not incremented when invoking request completion handlers. Request completions are triggered by timer interrupts that emulate device IRQs in a real USB Device Controller (UDC). The synchronization routine therefore returned while completion callbacks could still be in flight.

This incorrect synchronization allows subsequent teardown paths to proceed prematurely. The gadget driver's unbind routine may execute before all outstanding completion callbacks finish. If the module is unloaded while a completion handler still runs, kernel execution can continue in freed text pages, producing memory corruption or a kernel panic.

Root Cause

The root cause is incomplete tracking of in-flight callback contexts. The callback_usage counter did not reflect active request completion handlers, so the emulated synchronize_irq() returned before quiescence was actually achieved. This is a classic race condition in reference accounting that produces a time-of-use hazard during driver teardown.

Attack Vector

Exploitation requires local kernel interaction with the USB gadget subsystem, typically through binding and unbinding gadget drivers against dummy-hcd. The vulnerability is primarily a stability and reliability issue reachable by privileged local workflows and automated kernel test suites. Public exploitation details are not available.

See the upstream stable commits for the technical fix:

Detection Methods for CVE-2026-98765

Indicators of Compromise

Kernel oops or panic messages referencing dummy_hcd, dummy_timer, or completion callbacks after module unload.
Use-after-free reports from KASAN pointing at drivers/usb/gadget/udc/dummy_hcd.c call paths.
Unexpected gadget driver unbind events closely followed by faults in freed module text.

Detection Strategies

Enable KASAN and lockdep in kernel test builds to surface the race during gadget bind and unbind cycles.
Audit running kernel versions against the fixed stable commits to identify unpatched hosts.
Monitor kernel ring buffer (dmesg) for faults originating in USB gadget completion paths.

Monitoring Recommendations

Centralize dmesg and /var/log/kern.log collection to catch sporadic kernel faults tied to USB gadget activity.
Track modprobe and rmmod activity for gadget driver modules to correlate teardown with subsequent kernel errors.
Validate that automated kernel CI pipelines run USB gadget subsystem tests with memory sanitizers enabled.

How to Mitigate CVE-2026-98765

Immediate Actions Required

Update to a Linux kernel version containing the upstream fix that increments callback_usage across request completion callbacks.
Rebuild and redeploy any custom kernels that include dummy-hcd to pick up the patched source.
Restrict loading of USB gadget test drivers on production hosts where they are not required.

Patch Information

The fix increments the callback_usage counter across request completion callbacks so that the emulated synchronize_irq() waits for all in-flight completion handlers before returning. Patches are available in multiple stable branches via the following commits: b263ff9b, 7ce4dca0, 6849e51b, 5298c96b, and 3070806a.

Workarounds

Prevent dummy_hcd from loading on systems that do not require USB gadget emulation by blacklisting the module.
Avoid unloading gadget driver modules on affected kernels while USB traffic is active.
Limit local access to privileged users who can bind and unbind USB gadget drivers.

bash

# Blacklist dummy_hcd on hosts that do not require USB gadget emulation
echo 'blacklist dummy_hcd' | sudo tee /etc/modprobe.d/blacklist-dummy-hcd.conf
sudo depmod -a

# Verify running kernel version against patched stable releases
uname -r