Description
In the Linux kernel, the following vulnerability has been resolved:

USB: cdc-acm: skip URB restart in port_shutdown if disconnected

acm_port_shutdown() is called from the tty-port machinery whenever the
last user closes the port. acm_disconnect() sets acm->disconnected and
calls tty_port_tty_vhangup(), which eventually triggers port_shutdown().
At that point acm_disconnect() has already called acm_poison_urbs() and
is about to free the control and read URBs.

However, acm_port_shutdown() unconditionally calls acm_unpoison_urbs()
and, when the ALWAYS_POLL_CTRL quirk is set, immediately re-submits the
ctrlurb and all read URBs. If the concurrent acm_disconnect() then
frees those URBs and their DMA buffers while they are in-flight, the
result is a use-after-free in acm_ctrl_irq() or acm_read_bulk_callback()
accessing the freed DMA memory.

Fix by checking acm->disconnected after draining the delayed anchor and
returning early: if we are in a disconnect path the URBs must remain
poisoned and must not be resubmitted.

The early return is placed after the delayed-anchor drain loop because
that loop only cancels write-side accounting (wb->use = false and
autopm counter) and does not touch the hardware path.
Published: 2026-10-18
Score: 4.7 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Use‑after‑free leading to kernel memory corruption
Action: Patch
AI Analysis

Impact

The Linux kernel’s CDC‑ACM driver contains a flaw that allows a use‑after‑free of USB request blocks (URBs) and their associated DMA buffers when a CDC‑ACM device is disconnected while its URBs are still pending. When a disconnect call is processed, the driver frees the URBs but the shutdown routine may unconditionally restart and resubmit them, causing access to memory that has already been freed. The flaw is classified as CWE‑825 and can result in kernel memory corruption or a crash.

Affected Systems

All Linux kernel releases that contain the CDC‑ACM driver prior to the inclusion of commit 420ca35af891d33522cc08504768ccd60a4c450a are affected. This includes any system that loads the ‘acm’ driver and connects a CDC‑ACM USB device that has the ALWAYS_POLL_CTRL quirk enabled.

Risk and Exploitability

The CVSS base score of 4.7 reflects moderate severity. The EPSS score is below 1 % and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector is local: a user with physical access to a CDC‑ACM USB device that triggers a disconnect while URBs are in flight could exploit the flaw, potentially leading to a kernel crash or memory corruption.

Generated by OpenCVE AI on October 23, 2026 at 18:50 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update the kernel to a revision that includes commit 420ca35af891d33522cc08504768ccd60a4c450a, which fixes the use‑after‑free.
  • If an update is not immediately possible, disable the CDC‑ACM driver on hosts that do not require serial‑over‑USB by removing or blacklisting the module.
  • Restrict CDC‑USB device usage with udev rules or system security policies, and avoid enabling the ALWAYS_POLL_CTRL quirk until the kernel update is applied.

Generated by OpenCVE AI on October 23, 2026 at 18:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4850-1 linux-6.12 security update
History

Fri, 30 Oct 2026 13:00:00 +0000

Type Values Removed Values Added
References

Fri, 23 Oct 2026 12:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-825
References
Metrics threat_severity

None

 cvssV3_1

{'score': 4.7, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Moderate

Wed, 21 Oct 2026 13:15:00 +0000

Type Values Removed Values Added
References

Sun, 18 Oct 2026 16:00:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: USB: cdc-acm: skip URB restart in port_shutdown if disconnected acm_port_shutdown() is called from the tty-port machinery whenever the last user closes the port. acm_disconnect() sets acm->disconnected and calls tty_port_tty_vhangup(), which eventually triggers port_shutdown(). At that point acm_disconnect() has already called acm_poison_urbs() and is about to free the control and read URBs. However, acm_port_shutdown() unconditionally calls acm_unpoison_urbs() and, when the ALWAYS_POLL_CTRL quirk is set, immediately re-submits the ctrlurb and all read URBs. If the concurrent acm_disconnect() then frees those URBs and their DMA buffers while they are in-flight, the result is a use-after-free in acm_ctrl_irq() or acm_read_bulk_callback() accessing the freed DMA memory. Fix by checking acm->disconnected after draining the delayed anchor and returning early: if we are in a disconnect path the URBs must remain poisoned and must not be resubmitted. The early return is placed after the delayed-anchor drain loop because that loop only cancels write-side accounting (wb->use = false and autopm counter) and does not touch the hardware path.
Title USB: cdc-acm: skip URB restart in port_shutdown if disconnected
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-10-30T12:39:41.890Z

Reserved: 2026-09-25T10:25:14.369Z

Link: CVE-2026-98773

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-18T16:17:31.223

Modified: 2026-10-30T13:21:27.007

Link: CVE-2026-98773

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-10-18T00:00:00Z

Links: CVE-2026-98773 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-23T19:00:23Z

Weaknesses
  • CWE-825

    Expired Pointer Dereference