CVE-2026-98763: usb: core: clear both ep_in and ep_out for non-ep0 control endpoints
In the Linux kernel, the following vulnerability has been resolved:
usb: core: clear both epin and epout for non-ep0 control endpoints
In usbenableendpoint(), non-zero control endpoints (where usbendpointxfercontrol(&ep->desc) is true) populate both dev->epin[epnum] and dev->epout[epnum] with the same struct usbhostendpoint pointer.
However, usbdisableendpoint() only clears either dev->epout[epnum] or dev->epin[epnum] depending on the direction bit of epaddr when resethardware is set, leaving the opposite direction's array slot pointing to the disabled/freed endpoint.
Clear both dev->epout[epnum] and dev->epin[epnum] when disabling a non-ep0 control endpoint with resethardware set, and update the function kerneldoc accordingly.
Tested in QEMU against Linux 7.3.0-rc3 using dummyhcd and raw-gadget to enumerate a USB device with a non-zero control endpoint (bEndpointAddress 0x01, bmAttributes USBENDPOINTXFERCONTROL), verifying that both dev->epin[1] and dev->epout[1] are cleared when the interface is disabled.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.113-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.2.10-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 5.10.273 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 5.15.224 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.191 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.160 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.113 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.56 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.2.10 - Upgrade
Upgrade
azurelinux/kernelto a version that resolves this vulnerability.Fixed in 6.6.161.1-1
Event History
Frequently Asked Questions
What USB configuration is required for this issue to occur?
The USB device must expose a non-zero control endpoint. Such an endpoint is represented in both the kernel's input and output endpoint arrays, but the affected disable path clears only one of those entries.
When does the stale endpoint reference remain present?
It occurs when the kernel disables a non-zero control endpoint with reset_hardware set. The array entry opposite to the endpoint address direction can continue pointing to the disabled or freed endpoint.
How can I determine whether a system has the affected behavior?
Enumerate a USB device with a non-zero control endpoint, disable its interface with reset_hardware set, and inspect the corresponding ep_in and ep_out slots. An affected system leaves one slot populated; the resolved behavior clears both.