{"id":"CVE-2026-98767","title":"kernel: usb: dwc3: gadget: fix IRQ storm on invalid event buffer count (CVE-2026-98767)","summary":"A flaw was found in the Linux kernel's DWC3 USB gadget driver. When an invalid event buffer count exceeding the buffer size is encountered, the driver fails to acknowledge and clear the hardware interrupt source before returning. This leav…","severity":"medium","cvss":5.1,"cvssVector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","cvssSource":"vendor","cwe":"CWE-390","vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","affected":["enterprise_linux 10","enterprise_linux 9","openshift_container_platform 4"],"published":"2026-10-18","updated":"2026-10-23","sourceUpdated":"2026-10-23T06:41:05+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98767.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98767.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-98767"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2555069"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-98767"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98767"},{"url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98767.mbox"},{"url":"https://git.kernel.org/stable/c/6cd82563bb270e03fe2f91324660ea14e3ce5d1a"},{"url":"https://git.kernel.org/stable/c/96918ca25ff467c25675478fc79393df4ae9d74c"},{"url":"https://git.kernel.org/stable/c/ba927133b301894e7d24099afbb701887c8cd2f1"},{"url":"https://git.kernel.org/stable/c/f51cadb02b439850ab411df0a2cf4288a66d42e2"},{"url":"https://git.kernel.org/stable/c/1ff77cbefe5a653ea12874c213ea4bd0d72c1067"}],"tags":["csaf","vex","red-hat","cve.org"],"epss":0.00168,"epssPercentile":0.05982,"ingestedAt":"2026-10-18T16:47:32.494Z","slug":"CVE-2026-98767","body":"## Overview\n\nA flaw was found in the Linux kernel's DWC3 USB gadget driver. When an invalid event buffer count exceeding the buffer size is encountered, the driver fails to acknowledge and clear the hardware interrupt source before returning. This leaves the interrupt line continuously asserted, triggering an interrupt request (IRQ) storm of unhandled interrupts. This condition ultimately causes a kernel panic, resulting in a system Denial of Service (DoS).\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · updated 2026-10-23 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98767.json)\n\n**kernel: usb: dwc3: gadget: fix IRQ storm on invalid event buffer count** — rated Moderate by Red Hat. Released 2026-10-18, updated 2026-10-23.\n\nAffected:\n\n- Red Hat Enterprise Linux 10\n- Red Hat Enterprise Linux 9\n- Red Hat OpenShift Container Platform 4\n\nNo fix planned:\n\n- Red Hat Enterprise Linux 10\n- Red Hat Enterprise Linux 9\n- Red Hat OpenShift Container Platform 4\n\nNot affected:\n\n- Red Hat Enterprise Linux 6\n- Red Hat Enterprise Linux 7\n- Red Hat Enterprise Linux 8\n- Red Hat OpenShift Container Platform 4\n\n## Remediation\n\nFix deferred","depth":"sunlit","depthScore":28,"depthScoreParts":{"impact":28.1,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":228147,"id":"CVE-2026-98767","ts":1792758131763,"field":"cvss","old":null,"new":"5.1"},{"seq":228146,"id":"CVE-2026-98767","ts":1792758131763,"field":"severity","old":"none","new":"medium"}]}