CVE-2026-98697 PUBLISHED

USB: serial: fix dynamic id driver deregistration race

Assigner: Linux
Reserved: 25.09.2026 Published: 18.10.2026 Updated: 18.10.2026

In the Linux kernel, the following vulnerability has been resolved:

USB: serial: fix dynamic id driver deregistration race

Only free the dynamic ids after having deregistered the driver and removed the "new_id" attribute to avoid leaking any id added by a racing write to the attribute.

Product Status

Vendor Linux
Product Linux
Versions Default: unaffected
  • affected from 93bacefc4cc0b53e1cb6a336d43847154fdf6886 to ebd8fcaaacb66c15ae7e19d14619abe3762e0701 (excl.)
  • affected from 93bacefc4cc0b53e1cb6a336d43847154fdf6886 to 4d6da6867b4ac6468d634a0dd3c35dfc0dc8af81 (excl.)
  • affected from 93bacefc4cc0b53e1cb6a336d43847154fdf6886 to 380f57cd58e26e0f3687451196ec446c473c52d9 (excl.)
  • affected from 93bacefc4cc0b53e1cb6a336d43847154fdf6886 to 63594e8ffe097bc0b7639936f33799a7653dded2 (excl.)
Vendor Linux
Product Linux
Versions Default: affected
  • Version 2.6.21 is affected
  • unaffected from 0 to 2.6.21 (excl.)
  • unaffected from 6.12.113 to 6.12.* (incl.)
  • unaffected from 6.18.56 to 6.18.* (incl.)
  • unaffected from 7.2.10 to 7.2.* (incl.)
  • unaffected from 7.3-rc6 to * (incl.)

References