CVE-2026-98933 - Vulnerability Details

- usb: hub: use shorter 120ms post resume hold for SS root hubs

Description

In the Linux kernel, the following vulnerability has been resolved:

usb: hub: use shorter 120ms post resume hold for SS root hubs

Holding a USB3 hub PM runtime reference for 200ms at hub resume triggers
an AMD platform issue. Users running Android adb report crashes after
adb has been polling and waking up the USB subsystem once a second for
some time. Vendors are working on a solution. Disabling USB runtime PM
is one way to prevent this issue, but it is also proven that reducing the
hold time to 120ms in resume also mitigates it. See Link for more
details.

Reducing the hold time to 120ms for the USB3 roothub is in itself a valid
change and optimization, as the current 200ms is excessive: a root hub
has no upstream suspended hub whose wake propagation needs to be
accounted for, but still need some time for USB3 link training to
complete.

Keep the 200ms hold for external hubs that commit 8f5b7e2bec1c
("usb: hub: fix detection of high tier USB3 devices behind suspended
hubs") is intended for.

Published: 2026-10-23

Score: 4.7 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The bug in the Linux kernel’s USB hub code holds a runtime power‑management reference for 200 ms during USB3 root hub resume. On AMD platforms this excessive delay triggers a fatal fault that can crash the kernel, effectively causing a denial of service. The issue is associated with CWE‑821 as identified by the advisory.

Affected Systems

Linux kernels that enable USB3 runtime power management and include the default 200 ms hold logic in the hub code are affected. The change applies to any kernel that compiled the hub driver without the recent patch; vendor names are Linux, and no specific version numbers are listed in the advisory.

Risk and Exploitability

The CVSS score of 4.7 indicates moderate severity, and the EPSS score of less than 1% suggests a very low likelihood of exploitation. The vulnerability is not listed in CISA KEV. The attack vector is local: an attacker would need to trigger repeated resume events on the target device, such as via Android ADB polling, to provoke the crash.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`8aa04df2553f29e6249f978a29421f2744a65ffb`	affected	< ff21323b74a876c54b1ebe9e5f8ba5abc7e07fd3
`e38ca702130b7d70834abdbee58135ca471b2106`	affected	< 73d4fbc496935ccaffba15ca5ec33660c2b587fb
`43e53eb8433c332666a222bff8e49aa03a470d0d`	affected	< 86e0baedd55fca30081fcd858ab336dfc0f1cc09
`15fea75a788681dd36a869dd90ff4f0461ea0714`	affected	< e4df763ba3c4fdd1d9256f7a75a17ab7c5e31db6
`aec11e5f9c452ef64e2c113637ab89a67a5ceb62`	affected	< 2dc82d6a12050c2c678a328cd29837beb367df7d
`8f5b7e2bec1c36578fdaa74a6951833541103e27`	affected	< e9545dd8bc62596b2a20966be41f39879ea7c8d0
`8f5b7e2bec1c36578fdaa74a6951833541103e27`	affected	< d7c4a49b41583266e1456d40f37966029f61dab9
`8f5b7e2bec1c36578fdaa74a6951833541103e27`	affected	< 29480b05e6e226594dc11ccf2a036fbd5cdd0e42
`042959e9b479502a921109224c3abcc3d3cf09a1`	affected	—
`16840c4e102ee5424ab1c49238f0bbf568d13a1c`	affected	—
`5.10.241`	affected	< 5.10.273
`5.15.190`	affected	< 5.15.224
`6.1.147`	affected	< 6.1.191
`6.6.100`	affected	< 6.6.160
`6.12.40`	affected	< 6.12.113
`5.4.297`	affected	< 5.5
`6.15.8`	affected	< 6.16

Linux

affected

Version	Status	Constraints
`6.16`	affected	—
`0`	unaffected	< 6.16
`5.10.273`	unaffected	≤ 5.10.*
`5.15.224`	unaffected	≤ 5.15.*
`6.1.191`	unaffected	≤ 6.1.*
`6.6.160`	unaffected	≤ 6.6.*
`6.12.113`	unaffected	≤ 6.12.*
`6.18.56`	unaffected	≤ 6.18.*
`7.2.10`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

100%

Version	Status	Scheme	Platform
`[15fea75a788681dd36a869dd90ff4f0461ea0714,e4df763ba3c4fdd1d9256f7a75a17ab7c5e31db6)`	affected	code_commit	—
`[aec11e5f9c452ef64e2c113637ab89a67a5ceb62,2dc82d6a12050c2c678a328cd29837beb367df7d)`	affected	code_commit	—
`[8f5b7e2bec1c36578fdaa74a6951833541103e27,e9545dd8bc62596b2a20966be41f39879ea7c8d0)`	affected	code_commit	—
`[8f5b7e2bec1c36578fdaa74a6951833541103e27,d7c4a49b41583266e1456d40f37966029f61dab9)`	affected	code_commit	—
`[8f5b7e2bec1c36578fdaa74a6951833541103e27,29480b05e6e226594dc11ccf2a036fbd5cdd0e42)`	affected	code_commit	—
`042959e9b479502a921109224c3abcc3d3cf09a1`	affected	code_commit	—
`8aa04df2553f29e6249f978a29421f2744a65ffb`	affected	code_commit	—
`e38ca702130b7d70834abdbee58135ca471b2106`	affected	code_commit	—
`43e53eb8433c332666a222bff8e49aa03a470d0d`	affected	code_commit	—
`16840c4e102ee5424ab1c49238f0bbf568d13a1`	affected	code_commit	—
`[6.6.100,6.6.160)`	affected	semver	—
`[6.12.40,6.12.113)`	affected	semver	—
`[5.4.297,5.5)`	affected	semver	—
`[5.10.241,5.11)`	affected	semver	—
`[5.15.190,5.16)`	affected	semver	—
`[6.1.147,6.2)`	affected	semver	—
`[6.15.8,6.16)`	affected	semver	—

Linux

100%

Version	Status	Scheme	Platform
`6.16`	affected	semver	—
`[0,6.16)`	unaffected	semver	—
`[6.6.160,6.7.0)`	unaffected	semver	—
`[6.12.113,6.13.0)`	unaffected	semver	—
`[6.18.56,6.19.0)`	unaffected	semver	—
`[7.2.10,7.3.0)`	unaffected	semver	—
`[7.3,*]`	unaffected	generic	—
`[7.3,*]`	unaffected	generic	—

Linux

Linux Kernel

100%

Version	Status	Scheme	Platform
`[15fea75a788681dd36a869dd90ff4f0461ea0714,e4df763ba3c4fdd1d9256f7a75a17ab7c5e31db6)`	affected	code_commit	—
`[aec11e5f9c452ef64e2c113637ab89a67a5ceb62,2dc82d6a12050c2c678a328cd29837beb367df7d)`	affected	code_commit	—
`[8f5b7e2bec1c36578fdaa74a6951833541103e27,e9545dd8bc62596b2a20966be41f39879ea7c8d0)`	affected	code_commit	—
`[8f5b7e2bec1c36578fdaa74a6951833541103e27,d7c4a49b41583266e1456d40f37966029f61dab9)`	affected	code_commit	—
`[8f5b7e2bec1c36578fdaa74a6951833541103e27,29480b05e6e226594dc11ccf2a036fbd5cdd0e42)`	affected	code_commit	—
`042959e9b479502a921109224c3abcc3d3cf09a1`	affected	code_commit	—
`8aa04df2553f29e6249f978a29421f2744a65ffb`	affected	code_commit	—
`e38ca702130b7d70834abdbee58135ca471b2106`	affected	code_commit	—
`43e53eb8433c332666a222bff8e49aa03a470d0d`	affected	code_commit	—
`16840c4e102ee5424ab1c49238f0bbf568d13a1`	affected	code_commit	—
`[6.6.100,6.6.160)`	affected	semver	—
`[6.12.40,6.12.113)`	affected	semver	—
`[5.4.297,5.5)`	affected	semver	—
`[5.10.241,5.11)`	affected	semver	—
`[5.15.190,5.16)`	affected	semver	—
`[6.1.147,6.2)`	affected	semver	—
`[6.15.8,6.16)`	affected	semver	—

Linux

Linux Kernel

100%

Version	Status	Scheme	Platform
`6.16`	affected	semver	—
`[0,6.16)`	unaffected	semver	—
`[6.6.160,6.7.0)`	unaffected	semver	—
`[6.12.113,6.13.0)`	unaffected	semver	—
`[6.18.56,6.19.0)`	unaffected	semver	—
`[7.2.10,7.3.0)`	unaffected	semver	—
`[7.3,*]`	unaffected	generic	—
`[7.3,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the kernel patch that reduces the post-resume hold time for USB3 root hubs to the recommended 120 ms
Disable USB runtime power management globally or for USB ports to prevent the 200 ms hold that triggers the crash
Upgrade to a kernel version that implements the 120 ms post-resume hold fix

Generated by OpenCVE AI on October 29, 2026 at 23:16 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Ubuntu USN	USN-9018-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9018-2	Linux kernel (HWE) vulnerabilities
Ubuntu USN	USN-9019-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9020-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9022-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9023-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9024-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9025-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9026-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9039-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-9040-1	Linux kernel (Low Latency NVIDIA) vulnerabilities
Ubuntu USN	USN-9066-1	Linux kernel (HWE) vulnerabilities

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00177.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98933.mbox
https://git.kernel.org/stable/c/29480b05e6e226594dc11ccf2a036fbd5cdd0e42
https://git.kernel.org/stable/c/2dc82d6a12050c2c678a328cd29837beb367df7d
https://git.kernel.org/stable/c/73d4fbc496935ccaffba15ca5ec33660c2b587fb
https://git.kernel.org/stable/c/86e0baedd55fca30081fcd858ab336dfc0f1cc09
https://git.kernel.org/stable/c/d7c4a49b41583266e1456d40f37966029f61dab9
https://git.kernel.org/stable/c/e4df763ba3c4fdd1d9256f7a75a17ab7c5e31db6
https://git.kernel.org/stable/c/e9545dd8bc62596b2a20966be41f39879ea7c8d0
https://git.kernel.org/stable/c/ff21323b74a876c54b1ebe9e5f8ba5abc7e07fd3
https://nvd.nist.gov/vuln/detail/CVE-2026-98933
https://www.cve.org/CVERecord?id=CVE-2026-98933

History

Fri, 30 Oct 2026 13:00:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/73d4fbc496935ccaffba15ca5ec33660c2b587fb https://git.kernel.org/stable/c/86e0baedd55fca30081fcd858ab336dfc0f1cc09 https://git.kernel.org/stable/c/ff21323b74a876c54b1ebe9e5f8ba5abc7e07fd3

Thu, 29 Oct 2026 21:15:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-362 CWE-416

Thu, 29 Oct 2026 12:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-821
References		https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98933.mbox https://nvd.nist.gov/vuln/detail/CVE-2026-98933 https://www.cve.org/CVERecord?id=CVE-2026-98933
Metrics	threat_severity `None`	cvssV3_1 `{'score': 4.7, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Fri, 23 Oct 2026 21:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Linux linux
Vendors & Products		Linux linux

Fri, 23 Oct 2026 15:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-362 CWE-416

Fri, 23 Oct 2026 12:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: usb: hub: use shorter 120ms post resume hold for SS root hubs Holding a USB3 hub PM runtime reference for 200ms at hub resume triggers an AMD platform issue. Users running Android adb report crashes after adb has been polling and waking up the USB subsystem once a second for some time. Vendors are working on a solution. Disabling USB runtime PM is one way to prevent this issue, but it is also proven that reducing the hold time to 120ms in resume also mitigates it. See Link for more details. Reducing the hold time to 120ms for the USB3 roothub is in itself a valid change and optimization, as the current 200ms is excessive: a root hub has no upstream suspended hub whose wake propagation needs to be accounted for, but still need some time for USB3 link training to complete. Keep the 200ms hold for external hubs that commit 8f5b7e2bec1c ("usb: hub: fix detection of high tier USB3 devices behind suspended hubs") is intended for.
Title		usb: hub: use shorter 120ms post resume hold for SS root hubs
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/29480b05e6e226594dc11ccf2a036fbd5cdd0e42 https://git.kernel.org/stable/c/2dc82d6a12050c2c678a328cd29837beb367df7d https://git.kernel.org/stable/c/d7c4a49b41583266e1456d40f37966029f61dab9 https://git.kernel.org/stable/c/e4df763ba3c4fdd1d9256f7a75a17ab7c5e31db6 https://git.kernel.org/stable/c/e9545dd8bc62596b2a20966be41f39879ea7c8d0

Subscriptions

Linux Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-10-23T12:11:39.531Z

Updated: 2026-10-30T12:40:22.693Z

Reserved: 2026-09-25T10:25:14.381Z

Link: CVE-2026-98933

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-10-23T13:17:14.120

Modified: 2026-10-30T13:21:31.727

Link: CVE-2026-98933

Redhat

Severity : Moderate

Publid Date: 2026-10-23T00:00:00Z

Links: CVE-2026-98933 - Bugzilla

OpenCVE Enrichment

Updated: 2026-10-29T23:30:03Z

Weaknesses

CWE-821
Incorrect Synchronization

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object