CVE-2026-98697: USB: serial: fix dynamic id driver deregistration race

Published Oct 18, 2026

Updated

In the Linux kernel, the following vulnerability has been resolved:

USB: serial: fix dynamic id driver deregistration race

Only free the dynamic ids after having deregistered the driver and removed the "newid" attribute to avoid leaking any id added by a racing write to the attribute.

Affected Software

1 affected component

Linux Linux kernel

Event History

Oct 18, 2026

CVE Published

via MITRE·03:46 PM

Data Sourced

via MITRE·03:46 PM

Description

Data Sourced

via NVD·04:17 PM

Description

Frequently Asked Questions

What condition is required for this race to occur?

A write to the USB serial driver's "new_id" attribute must race with driver deregistration. The affected behavior is a dynamic ID added by that racing write being leaked.

What is the mitigation if an immediate kernel update is not possible?

The provided data does not identify a workaround. Reducing or preventing writes to the affected "new_id" attribute during USB serial driver deregistration would address the race condition described.

How can I determine whether a system is affected?

The provided information identifies the Linux kernel as affected but does not provide affected version ranges or configuration details. Compare the kernel source or applied stable patches with the referenced fixes.

CVE-2026-98697: USB: serial: fix dynamic id driver deregistration race

Affected Software

Event History

Frequently Asked Questions

What condition is required for this race to occur?

What is the mitigation if an immediate kernel update is not possible?

How can I determine whether a system is affected?

Company

Resources

Contact

Frequently Asked Questions

What condition is required for this race to occur?

What is the mitigation if an immediate kernel update is not possible?

How can I determine whether a system is affected?