CVE-2026-98773: USB: cdc-acm: skip URB restart in port_shutdown if disconnected
In the Linux kernel, the following vulnerability has been resolved:
USB: cdc-acm: skip URB restart in portshutdown if disconnected
acmportshutdown() is called from the tty-port machinery whenever the last user closes the port. acmdisconnect() sets acm->disconnected and calls ttyportttyvhangup(), which eventually triggers portshutdown(). At that point acmdisconnect() has already called acmpoisonurbs() and is about to free the control and read URBs.
However, acmportshutdown() unconditionally calls acmunpoisonurbs() and, when the ALWAYSPOLLCTRL quirk is set, immediately re-submits the ctrlurb and all read URBs. If the concurrent acmdisconnect() then frees those URBs and their DMA buffers while they are in-flight, the result is a use-after-free in acmctrlirq() or acmreadbulkcallback() accessing the freed DMA memory.
Fix by checking acm->disconnected after draining the delayed anchor and returning early: if we are in a disconnect path the URBs must remain poisoned and must not be resubmitted.
The early return is placed after the delayed-anchor drain loop because that loop only cancels write-side accounting (wb->use = false and autopm counter) and does not touch the hardware path.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.159.1-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.113-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.2.10-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.191 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.160 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.113 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.56 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.2.10 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Compensating control
In acm_port_shutdown(), drain the delayed anchor first, then check acm->disconnected and return early when it is set, so poisoned control and read URBs are not unpoisoned or resubmitted during disconnect.
Event History
Frequently Asked Questions
Which deployments are affected by this race condition?
It affects Linux systems using the CDC ACM USB driver when the ALWAYS_POLL_CTRL quirk is set. The vulnerable path involves a device disconnect occurring as the last user closes the associated tty port.
What sequence triggers the use-after-free?
During disconnect, the driver poisons URBs and prepares to free the control and read URBs. The port shutdown path can then unpoison and resubmit those URBs; if disconnect frees their URBs or DMA buffers while they are in flight, the control or read callback can access freed memory.