Not yet scoredPublished Sep 24, 2026

CVE-2026-97483usb: core: hcd: fix possible deadlock in rh control transfers

Updated under an hour ago (Oct 28, 2026, 2:40 AM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: usb: core: hcd: fix possible deadlock in rh control transfers >From within the SCSI error handler memory allocations must not trigger IO. Handling errors in UAS and the storage driver may involve resetting a device. The thread doing the reset itself relies on VM magic. However, that is insufficient, as resetting a device involves resuming it. Resumption as well as resetting involves conrol transfers to the parent of the device to be reset. That may be a root hub. Hence usbcore must heed the flags passed to usb_submit_urb() processing control transfers to root hubs. The problem exist since the storage driver has been merged.

CVSS: Not yet scored
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Received
Record last updated: Oct 3, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from e57e780b346a7277fdd3bde765d9d8728b99bfa1 before 8461eda5af77c44d216cec66455bd5b01ee35c9a; from e57e780b346a7277fdd3bde765d9d8728b99bfa1 before 8f82fc3d72e5feb7a1efae94b51b431c5bf41c86; from e57e780b346a7277fdd3bde765d9d8728b99bfa1 before 936b08d87c667031725bcc753007e7c1182548c6; from e57e780b346a7277fdd3bde765d9d8728b99bfa1 before d0291fb4d91982d9f6a680bf759ff0555d351ecb; from e57e780b346a7277fdd3bde765d9d8728b99bfa1 before fff917c85d37a294397c5440a795591ca9d6b602; from e57e780b346a7277fdd3bde765d9d8728b99bfa1 before 549672a3fb6b36ea408238f89ecf9f41d2da6225; from e57e780b346a7277fdd3bde765d9d8728b99bfa1 before d5559f43d76b398392b26a15cbc16d731969cd1c	CNA record

References

References

https://git.kernel.org/stable/c/8461eda5af77c44d216cec66455bd5b01ee35c9a
https://git.kernel.org/stable/c/8f82fc3d72e5feb7a1efae94b51b431c5bf41c86
https://git.kernel.org/stable/c/936b08d87c667031725bcc753007e7c1182548c6
https://git.kernel.org/stable/c/d0291fb4d91982d9f6a680bf759ff0555d351ecb
https://git.kernel.org/stable/c/fff917c85d37a294397c5440a795591ca9d6b602
https://git.kernel.org/stable/c/549672a3fb6b36ea408238f89ecf9f41d2da6225
https://git.kernel.org/stable/c/d5559f43d76b398392b26a15cbc16d731969cd1c

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.