CVE-2026-98773

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

USB: cdc-acm: skip URB restart in port_shutdown if disconnected

acm_port_shutdown() is called from the tty-port machinery whenever the

last user closes the port. acm_disconnect() sets acm->disconnected and

calls tty_port_tty_vhangup(), which eventually triggers port_shutdown().

At that point acm_disconnect() has already called acm_poison_urbs() and

is about to free the control and read URBs.

However, acm_port_shutdown() unconditionally calls acm_unpoison_urbs()

and, when the ALWAYS_POLL_CTRL quirk is set, immediately re-submits the

ctrlurb and all read URBs. If the concurrent acm_disconnect() then

frees those URBs and their DMA buffers while they are in-flight, the

result is a use-after-free in acm_ctrl_irq() or acm_read_bulk_callback()

accessing the freed DMA memory.

Fix by checking acm->disconnected after draining the delayed anchor and

returning early: if we are in a disconnect path the URBs must remain

poison

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References