CVE-2026-98767: Linux Kernel DWC3 USB DoS Vulnerability

CVE-2026-98767 Overview

CVE-2026-98767 is a denial-of-service vulnerability in the Linux kernel's DesignWare USB 3.0 (DWC3) gadget driver. The flaw lives in dwc3_check_event_buf(), which handles event buffer processing for the USB controller. When the function reads a GEVNTCOUNT value that exceeds the event buffer length, it returns IRQ_NONE without writing the value back to clear the interrupt source. Because the DWC3 interrupt line is level-triggered, the uncleared source keeps the line asserted. The kernel then accumulates roughly 99,900 unhandled interrupts before spurious.c:184 triggers a BUG and the system panics.

Critical Impact
An invalid or corrupted GEVNTCOUNT register value causes a tight interrupt storm that crashes the kernel through the spurious-IRQ detection path.

Affected Products

Linux kernel versions containing commit 63ccd26cd1f6 ("usb: dwc3: gadget: check that event count does not exceed event buffer length")
Systems using the DesignWare USB 3.0 (DWC3) controller in gadget mode
Embedded and mobile Linux platforms that rely on the DWC3 driver for USB peripheral functionality

Discovery Timeline

2026-10-18 - CVE-2026-98767 published to NVD
2026-10-21 - Last updated in NVD database

Technical Details for CVE-2026-98767

Vulnerability Analysis

The DWC3 gadget driver reads the GEVNTCOUNT register to determine how many bytes of event data are ready for processing. A prior hardening commit added a sanity check that returns IRQ_NONE when the reported count exceeds the configured event buffer length. The check prevents out-of-bounds consumption of event data, but it leaves the interrupt source unacknowledged in the controller. Because the DWC3 interrupt is level-triggered rather than edge-triggered, the controller continues to assert the line until software writes the count value back to GEVNTCOUNT.

The result is a tight interrupt storm. The kernel's spurious-interrupt detector in kernel/irq/spurious.c tolerates a bounded number of unhandled events before concluding the line is misbehaving. After roughly 99,900 unhandled interrupts the detector triggers a BUG at spurious.c:184, producing a kernel panic with a call stack through __report_bad_irq, note_interrupt, handle_irq_event, handle_fasteoi_irq, and gic_handle_irq.

Root Cause

The root cause is incomplete interrupt acknowledgment. The defensive check added by commit 63ccd26cd1f6 returned early without clearing the hardware source. For a level-triggered line, acknowledgment requires writing the consumed count back to GEVNTCOUNT, matching the stale-event clearing pattern already used in dwc3_event_buffers_setup(). This is a kernel driver flaw [CWE-kernel] that converts a defensive validation into a persistent denial-of-service condition.

Attack Vector

Triggering the condition requires the ability to influence the value in GEVNTCOUNT. The reporter demonstrated the panic by writing a bogus value directly to the memory-mapped register using devmem <DWC3_BASE + 0xc40c> 4 0x1004. In practice, the fault can also occur due to hardware glitches, controller state corruption, or malformed activity on the USB bus that drives the controller into an inconsistent event-buffer state. Any path that produces an out-of-range GEVNTCOUNT reading is sufficient to crash the kernel.

The fix writes the invalid count back to GEVNTCOUNT to clear the interrupt source and schedules controller error recovery to reinitialize the DWC3 block. See the fix in Kernel Commit 1ff77cbefe5a and the backports in Kernel Commit 6cd82563bb27, Kernel Commit 96918ca25ff4, Kernel Commit ba927133b301, and Kernel Commit f51cadb02b43.

Detection Methods for CVE-2026-98767

Indicators of Compromise

Kernel panic with kernel BUG at kernel/irq/spurious.c:184 in system logs
Call stack containing __report_bad_irq, note_interrupt, handle_fasteoi_irq, and gic_handle_irq prior to the crash
/proc/interrupts showing rapid, abnormal growth on the DWC3 interrupt line immediately before the panic
Dmesg messages referencing unhandled interrupts attributed to the dwc3 driver

Detection Strategies

Monitor kernel ring buffer output for the spurious-IRQ BUG signature and correlate with DWC3 driver activity
Alert on sudden spikes in per-IRQ counters for the DWC3 line that are not matched by legitimate USB device traffic
Collect crash dumps and inspect for the characteristic ~99,900 unhandled interrupt count that precedes the panic

Monitoring Recommendations

Centralize kernel logs from Linux endpoints and embedded systems and search for report_bad_irq and dwc3 co-occurrences
Track unexpected device reboots on platforms that expose USB gadget mode, which can indicate the fault is being triggered in the field
Baseline normal interrupt rates for USB controllers so sustained anomalies are flagged for investigation

How to Mitigate CVE-2026-98767

Immediate Actions Required

Apply the upstream fix from Kernel Commit 1ff77cbefe5a or the corresponding stable-tree backport that matches your kernel series
Rebuild and deploy affected kernels on all systems using the DWC3 gadget driver, including embedded and mobile devices
Restrict unprivileged access to /dev/mem and memory-mapped register regions so untrusted users cannot write arbitrary values to GEVNTCOUNT

Patch Information

The fix writes the invalid count back to GEVNTCOUNT to acknowledge and clear the interrupt source, consistent with the stale-event clearing pattern already used in dwc3_event_buffers_setup(). The patch also schedules DWC3 error recovery to reinitialize the controller after the invalid event is handled. Mainline and multiple stable branches have received backports, listed in the external references.

Workarounds

Where patching is not immediately possible, disable USB gadget functionality on affected devices by unloading the dwc3 module or disabling the controller in the device tree
Enforce kernel lockdown and strict CONFIG_STRICT_DEVMEM settings to block userspace writes to controller registers
Limit physical and administrative access to systems that must remain unpatched to reduce the chance of a triggered panic

bash

# Example: block loading of the vulnerable module until patched
echo "blacklist dwc3" | sudo tee /etc/modprobe.d/dwc3-cve-2026-98767.conf
sudo update-initramfs -u