CVE-2026-98767 PUBLISHED

usb: dwc3: gadget: fix IRQ storm on invalid event buffer count

Assigner: Linux
Reserved: 25.09.2026 Published: 18.10.2026 Updated: 18.10.2026

In the Linux kernel, the following vulnerability has been resolved:

usb: dwc3: gadget: fix IRQ storm on invalid event buffer count

When dwc3_check_event_buf() reads a GEVNTCOUNT value exceeding the event buffer length, commit 63ccd26cd1f6 ("usb: dwc3: gadget: check that event count does not exceed event buffer length") returns IRQ_NONE without writing back GEVNTCOUNT. Since the DWC3 interrupt is level-triggered, the uncleared IRQ source keeps the line asserted, causing a tight IRQ storm that accumulates 99,900 unhandled interrupts and triggers spurious.c:184 BUG -> kernel panic.

The resulting call stack: __report_bad_irq+0xac/0xc8 note_interrupt+0x340/0x468 handle_irq_event+0xac/0xc0 handle_fasteoi_irq+0x120/0x228 gic_handle_irq+0x68/0x108 ... kernel BUG at kernel/irq/spurious.c:184

To reproduce, write a bogus value exceeding the event buffer length directly to the GEVNTCOUNT register:

devmem <DWC3_BASE + 0xc40c> 4 0x1004

Write the bogus count back to GEVNTCOUNT to clear the IRQ source, consistent with the stale event clearing pattern in dwc3_event_buffers_setup(), and schedule error recovery to reinitialize the controller.

Product Status

Vendor Linux
Product Linux
Versions Default: unaffected
  • affected from 52a7c9d930b95aa8b1620edaba4818040c32631f to 96918ca25ff467c25675478fc79393df4ae9d74c (excl.)
  • affected from 63ccd26cd1f6600421795f6ca3e625076be06c9f to ba927133b301894e7d24099afbb701887c8cd2f1 (excl.)
  • affected from 63ccd26cd1f6600421795f6ca3e625076be06c9f to f51cadb02b439850ab411df0a2cf4288a66d42e2 (excl.)
  • affected from 63ccd26cd1f6600421795f6ca3e625076be06c9f to 1ff77cbefe5a653ea12874c213ea4bd0d72c1067 (excl.)
  • Version 015c39f38e69a491d2abd5e98869a500a9459b3b is affected
  • Version b43225948b231b3f331194010f84512bee4d9f59 is affected
  • Version c0079630f268843a25ed75226169cba40e0d8880 is affected
  • Version a44547015287a19001384fe94dbff84c92ce4ee1 is affected
  • Version c4d80e41cb42008dceb35e5dbf52574d93beac0d is affected
  • Version 99d655119b870ee60e4dbf310aa9a1ed8d9ede3d is affected
  • affected from 6.12.26 to 6.12.113 (excl.)
  • affected from 5.4.293 to 5.5 (excl.)
  • affected from 5.10.237 to 5.11 (excl.)
  • affected from 5.15.181 to 5.16 (excl.)
  • affected from 6.1.136 to 6.2 (excl.)
  • affected from 6.6.89 to 6.7 (excl.)
  • affected from 6.14.5 to 6.15 (excl.)
Vendor Linux
Product Linux
Versions Default: affected
  • Version 6.15 is affected
  • unaffected from 0 to 6.15 (excl.)
  • unaffected from 6.12.113 to 6.12.* (incl.)
  • unaffected from 6.18.56 to 6.18.* (incl.)
  • unaffected from 7.2.10 to 7.2.* (incl.)
  • unaffected from 7.3-rc6 to * (incl.)

References