CVE-2026-97483: usb: core: hcd: fix possible deadlock in rh control transfers
In the Linux kernel, the following vulnerability has been resolved:
usb: core: hcd: fix possible deadlock in rh control transfers
From within the SCSI error handler memory allocations must not trigger IO. Handling errors in UAS and the storage driver may involve resetting a device. The thread doing the reset itself relies on VM magic. However, that is insufficient, as resetting a device involves resuming it. Resumption as well as resetting involves conrol transfers to the parent of the device to be reset. That may be a root hub. Hence usbcore must heed the flags passed to usbsubmiturb() processing control transfers to root hubs.
The problem exist since the storage driver has been merged.
Affected Software
Event History
Frequently Asked Questions
Which systems are most likely to encounter this issue?
Systems using USB Attached SCSI (UAS) or USB storage devices are the relevant exposure area, particularly when the storage driver’s error handling resets a USB device. The issue has existed since the storage driver was merged.
What conditions trigger the deadlock?
The condition arises during SCSI error handling when a UAS or storage-device error leads to a device reset. Resetting or resuming the device can require USB control transfers to its parent, potentially a root hub, while the error-handling path must avoid memory allocations that trigger I/O.
What is the remediation?
Apply a kernel update containing the referenced stable fixes. The fix makes usbcore honor flags passed to usb_submit_urb() when processing control transfers to root hubs.