CVE-2026-98696: USB: serial: fix driver deregistration order
In the Linux kernel, the following vulnerability has been resolved:
USB: serial: fix driver deregistration order
USB serial driver modules register one driver for the USB bus and one or more drivers for the ports on the USB serial bus.
When unloading a driver module, the USB driver must be deregistered before the USB serial bus drivers so that I/O is stopped before unbinding the ports to avoid use-after-free in completion handlers accessing port data.
Note that the "newid" attributes must first be removed to prevent new ids from being added and triggering a probe of the USB driver after it has been deregistered.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.113-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.2.10-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 5.10.273 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 5.15.224 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.191 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.160 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.113 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.56 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.2.10 - Upgrade
Upgrade
azurelinux/kernelto a version that resolves this vulnerability.Fixed in 6.6.161.1-1 - Operational
When unloading a USB serial driver module, first remove its "new_id" attributes, then deregister the USB driver before deregistering the USB serial bus drivers, so I/O stops before ports are unbound and completion handlers cannot access freed port data.
Event History
Frequently Asked Questions
When is a system exposed to this issue?
Exposure occurs when a USB serial driver module is unloaded. The unsafe deregistration order can leave I/O completion handlers accessing port data after the ports have been unbound.
What condition triggers the use-after-free?
The issue requires unloading a USB serial driver module while I/O is still active or completion handlers can still run. A new ID added through a "new_id" attribute during teardown can also trigger a probe after the USB driver has been deregistered.
What is the relevant mitigation if the fix cannot be deployed immediately?
Avoid unloading affected USB serial driver modules while they may have active I/O. Ensure no new device IDs are added through the drivers' "new_id" attributes during module teardown.
How can administrators identify potentially affected activity?
Review whether USB serial driver modules are unloaded on the system, particularly while USB serial devices are active. Also check whether operational workflows add dynamic device IDs through "new_id" attributes.