Description
In the Linux kernel, the following vulnerability has been resolved:

usb: hub: use shorter 120ms post resume hold for SS root hubs

Holding a USB3 hub PM runtime reference for 200ms at hub resume triggers
an AMD platform issue. Users running Android adb report crashes after
adb has been polling and waking up the USB subsystem once a second for
some time. Vendors are working on a solution. Disabling USB runtime PM
is one way to prevent this issue, but it is also proven that reducing the
hold time to 120ms in resume also mitigates it. See Link for more
details.

Reducing the hold time to 120ms for the USB3 roothub is in itself a valid
change and optimization, as the current 200ms is excessive: a root hub
has no upstream suspended hub whose wake propagation needs to be
accounted for, but still need some time for USB3 link training to
complete.

Keep the 200ms hold for external hubs that commit 8f5b7e2bec1c
("usb: hub: fix detection of high tier USB3 devices behind suspended
hubs") is intended for.
Published: 2026-10-23
Score: n/a
EPSS: n/a
KEV: No
Impact: Denial of Service
Action: Apply Patch
AI Analysis

Impact

A bug in the Linux kernel’s USB3 root hub runtime power management holds a reference for 200 ms during resume, triggering an AMD platform fault that can cause the kernel to crash. The crash is usually observed after repeated wakeups by Android ADB polling the USB subsystem. The weakness involves improper reference handling that can lead to a use‑after‑free or race condition, resulting in system instability.

Affected Systems

Linux kernels with USB3 root hubs and runtime power management enabled are affected. The change is in the USB hub code and applies to any kernel that has this 200 ms hold‑time logic; specific version numbers are not listed in the advisory.

Risk and Exploitability

No EPSS score is reported and the issue is not currently listed in CISA KEV, so the overall likelihood of exploitation is uncertain. The CVSS score is not provided, but the potential for a kernel crash gives the vulnerability a high impact. The attack appears local, requiring access to the device to cause the resume wake‑up sequence (e.g., via adb). No remote trigger is documented.

Generated by OpenCVE AI on October 23, 2026 at 14:33 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Disable USB runtime PM globally or for USB ports to prevent the 200 ms hold that triggers the crash
  • Apply a kernel patch that reduces the post‑resume hold time for USB3 root hubs to the recommended 120 ms
  • Verify that the running kernel includes the fix or that USB runtime PM remains disabled; update to a newer kernel if available

Generated by OpenCVE AI on October 23, 2026 at 14:33 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 23 Oct 2026 15:00:00 +0000

Type Values Removed Values Added
Weaknesses CWE-362
CWE-416

Fri, 23 Oct 2026 12:30:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: usb: hub: use shorter 120ms post resume hold for SS root hubs Holding a USB3 hub PM runtime reference for 200ms at hub resume triggers an AMD platform issue. Users running Android adb report crashes after adb has been polling and waking up the USB subsystem once a second for some time. Vendors are working on a solution. Disabling USB runtime PM is one way to prevent this issue, but it is also proven that reducing the hold time to 120ms in resume also mitigates it. See Link for more details. Reducing the hold time to 120ms for the USB3 roothub is in itself a valid change and optimization, as the current 200ms is excessive: a root hub has no upstream suspended hub whose wake propagation needs to be accounted for, but still need some time for USB3 link training to complete. Keep the 200ms hold for external hubs that commit 8f5b7e2bec1c ("usb: hub: fix detection of high tier USB3 devices behind suspended hubs") is intended for.
Title usb: hub: use shorter 120ms post resume hold for SS root hubs
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-10-23T12:11:39.531Z

Reserved: 2026-09-25T10:25:14.381Z

Link: CVE-2026-98933

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-23T13:17:14.120

Modified: 2026-10-23T13:17:14.120

Link: CVE-2026-98933

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-23T14:45:17Z

Weaknesses
  • CWE-362

    Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

  • CWE-416

    Use After Free