CVE-2026-98763
In the Linux kernel, the following vulnerability has been resolved:
usb: core: clear both ep_in and ep_out for non-ep0 control endpoints
In usb_enable_endpoint(), non-zero control endpoints (where usb_endpoint_xfer_control(&ep->desc) is true) populate both dev->ep_in[epnum] and dev->ep_out[epnum] with the same struct usb_host_endpoint pointer.
However, usb_disable_endpoint() only clears either dev->ep_out[epnum] or dev->ep_in[epnum] depending on the direction bit of epaddr when reset_hardware is set, leaving the opposite direction's array slot pointing to the disabled/freed endpoint.
Clear both dev->ep_out[epnum] and dev->ep_in[epnum] when disabling a non-ep0 control endpoint with reset_hardware set, and update the function kerneldoc accordingly.
Read full descriptionShow less
Tested in QEMU against Linux 7.3.0-rc3 using dummy_hcd and raw-gadget to enumerate a USB device with a non-zero control endpoint (bEndpointAddress 0x01, bmAttributes USB_ENDPOINT_XFER_CONTROL), verifying that both dev->ep_in[1] and dev->ep_out[1] are cleared when the interface is disabled.
CVSS
NVD hasn't assigned a CVSS score to this CVE (common since the April 2026 policy change).
Exploitation probability (EPSS)
- Probability of exploitation in the next 30 days
- 0.17 %
- Percentile among all scored CVEs
- 6
- Score date
- 10/20/2026
EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).
Affected technologies (1)
⚠ AI-inferred from the description — NVD hasn't analyzed this CVE yet, these aren't verified CPEs.
References
Show 4 references
Raw JSON (NVD)
Show
{
"id": "CVE-2026-98763",
"cveTags": [],
"metrics": {},
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"lessThan": "7a9f61476b0e8002092a52ee8295edeeb0a28d1e",
"versionType": "git"
},
{
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"lessThan": "1da16c46b8d7101b74bc2d72a04e23cf5c7ddea1",
"versionType": "git"
},
{
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"lessThan": "c50413ecb662ea43c7f487632c8114721743a277",
"versionType": "git"
},
{
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"lessThan": "0e8baa78d872f2db440d8b9ded946ab8dceb89eb",
"versionType": "git"
}
],
"programFiles": [
"drivers/usb/core/message.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.12"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "2.6.12",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.12.113",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.56",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.2.10",
"versionType": "semver",
"lessThanOrEqual": "7.2.*"
},
{
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"drivers/usb/core/message.c"
],
"defaultStatus": "affected"
}
]
}
],
"published": "2026-10-18T16:17:30.113",
"references": [
{
"url": "https://git.kernel.org/stable/c/0e8baa78d872f2db440d8b9ded946ab8dceb89eb",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/1da16c46b8d7101b74bc2d72a04e23cf5c7ddea1",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/7a9f61476b0e8002092a52ee8295edeeb0a28d1e",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/c50413ecb662ea43c7f487632c8114721743a277",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: core: clear both ep_in and ep_out for non-ep0 control endpoints\n\nIn usb_enable_endpoint(), non-zero control endpoints (where\nusb_endpoint_xfer_control(&ep->desc) is true) populate both\ndev->ep_in[epnum] and dev->ep_out[epnum] with the same struct\nusb_host_endpoint pointer.\n\nHowever, usb_disable_endpoint() only clears either dev->ep_out[epnum] or\ndev->ep_in[epnum] depending on the direction bit of epaddr when\nreset_hardware is set, leaving the opposite direction's array slot\npointing to the disabled/freed endpoint.\n\nClear both dev->ep_out[epnum] and dev->ep_in[epnum] when disabling a\nnon-ep0 control endpoint with reset_hardware set, and update the\nfunction kerneldoc accordingly.\n\nTested in QEMU against Linux 7.3.0-rc3 using dummy_hcd and raw-gadget to\nenumerate a USB device with a non-zero control endpoint\n(bEndpointAddress 0x01, bmAttributes USB_ENDPOINT_XFER_CONTROL),\nverifying that both dev->ep_in[1] and dev->ep_out[1] are cleared when\nthe interface is disabled."
}
],
"lastModified": "2026-10-19T10:19:40.413",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}