CVE-2026-98762: USB: dwc2: shut down wakeup timer before freeing HCD state
In the Linux kernel, the following vulnerability has been resolved:
USB: dwc2: shut down wakeup timer before freeing HCD state
dwc2wakeupdetected() accesses the DWC2 host state and can rearm the wakeup timer. dwc2hcdfree() currently deletes the timer only after freeing host-owned state, and timerdelete() does not synchronize a callback or prevent it from being queued again.
Stop and shut down the timer in dwc2hcdrelease(), before the HCD resources are freed. This covers both the HCD initialization error path and normal HCD removal.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.113-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.2.10-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 5.15.224 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.191 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.160 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.113 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.56 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.2.10 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
azurelinux/kernelto a version that resolves this vulnerability.Fixed in 6.6.161.1-1 - Compensating control
In dwc2_hcd_release(), stop and shut down the wakeup timer before freeing HCD resources, covering both HCD initialization-error and normal HCD-removal paths; ensure the timer callback cannot be queued or rearmed after host-owned state is freed.
Event History
Frequently Asked Questions
When can this issue occur?
It can occur during DWC2 host-controller initialization failure handling or normal HCD removal, when the wakeup timer callback runs or is requeued after host-owned state has been freed.
What component must be in use to be affected?
Systems must be using the Linux kernel's DWC2 USB host-controller driver. The issue concerns the driver's wakeup timer and HCD resource teardown path.
What is the immediate mitigation if an updated kernel cannot be deployed?
The provided information does not identify a configuration workaround. Reducing or avoiding removal of the affected DWC2 host controller may avoid the teardown path, but no supported mitigation is specified.