Not yet scoredPublished Oct 18, 2026

CVE-2026-98762USB: dwc2: shut down wakeup timer before freeing HCD state

Updated under an hour ago (Oct 26, 2026, 6:00 PM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: USB: dwc2: shut down wakeup timer before freeing HCD state dwc2_wakeup_detected() accesses the DWC2 host state and can rearm the wakeup timer. dwc2_hcd_free() currently deletes the timer only after freeing host-owned state, and timer_delete() does not synchronize a callback or prevent it from being queued again. Stop and shut down the timer in dwc2_hcd_release(), before the HCD resources are freed. This covers both the HCD initialization error path and normal HCD removal.

CVSS: Not yet scored
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Received
Record last updated: Oct 21, 2026
First seen by InfoSec Signals: Oct 18, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	7359d482eb4d3967cc8be354405ae6be6eaf732c builds before 82cc242da6d621752718929e6a2fa6f9554ebffe; 7359d482eb4d3967cc8be354405ae6be6eaf732c builds before 441be312fce927443eae2821f502344d953c38bb; from 7359d482eb4d3967cc8be354405ae6be6eaf732c before 4333174ea52c863a50bb3e0a4726bf9f7cdf7524; 7359d482eb4d3967cc8be354405ae6be6eaf732c builds before 79ba37dd38a321cb32a79332a3e3c68dd334dca9; from 7359d482eb4d3967cc8be354405ae6be6eaf732c before fd772af9512cdecb83de34a461801533828e77fd	CNA record

References

References

https://git.kernel.org/stable/c/82cc242da6d621752718929e6a2fa6f9554ebffe
https://git.kernel.org/stable/c/441be312fce927443eae2821f502344d953c38bb
https://git.kernel.org/stable/c/4333174ea52c863a50bb3e0a4726bf9f7cdf7524
https://git.kernel.org/stable/c/79ba37dd38a321cb32a79332a3e3c68dd334dca9
https://git.kernel.org/stable/c/fd772af9512cdecb83de34a461801533828e77fd

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.