---
id: CVE-2026-98762
title: 'USB: dwc2: shut down wakeup timer before freeing HCD state'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  USB: dwc2: shut down wakeup timer before freeing HCD state

  dwc2_wakeup_detected() accesses the DWC2 host state and can rearm the
  wakeup timer.  dwc2_hcd_free() current…
severity: medium
cvss: 4.7
cvssVector: 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H'
cvssSource: vendor
cwe:
  - CWE-416
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 7359d482eb4d3967cc8be354405ae6be6eaf732c <
    82cc242da6d621752718929e6a2fa6f9554ebffe
  - >-
    Linux >= 7359d482eb4d3967cc8be354405ae6be6eaf732c <
    441be312fce927443eae2821f502344d953c38bb
  - >-
    Linux >= 7359d482eb4d3967cc8be354405ae6be6eaf732c <
    4333174ea52c863a50bb3e0a4726bf9f7cdf7524
  - >-
    Linux >= 7359d482eb4d3967cc8be354405ae6be6eaf732c <
    79ba37dd38a321cb32a79332a3e3c68dd334dca9
  - >-
    Linux >= 7359d482eb4d3967cc8be354405ae6be6eaf732c <
    fd772af9512cdecb83de34a461801533828e77fd
  - Linux 3.10
published: '2026-10-18'
updated: '2026-10-21'
sourceUpdated: '2026-10-21T12:56:36.466Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-98762'
references:
  - url: 'https://git.kernel.org/stable/c/82cc242da6d621752718929e6a2fa6f9554ebffe'
  - url: 'https://git.kernel.org/stable/c/441be312fce927443eae2821f502344d953c38bb'
  - url: 'https://git.kernel.org/stable/c/4333174ea52c863a50bb3e0a4726bf9f7cdf7524'
  - url: 'https://git.kernel.org/stable/c/79ba37dd38a321cb32a79332a3e3c68dd334dca9'
  - url: 'https://git.kernel.org/stable/c/fd772af9512cdecb83de34a461801533828e77fd'
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98762.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-98762'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2555157'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-98762'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-98762'
  - url: 'https://kernelcve.org/list/?q=CVE-2026-98762'
tags:
  - cve.org
  - csaf
  - vex
  - red-hat
epss: 0.00168
epssPercentile: 0.05973
ingestedAt: '2026-10-18T16:47:32.495Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

USB: dwc2: shut down wakeup timer before freeing HCD state

dwc2_wakeup_detected() accesses the DWC2 host state and can rearm the
wakeup timer.  dwc2_hcd_free() currently deletes the timer only after
freeing host-owned state, and timer_delete() does not synchronize a
callback or prevent it from being queued again.

Stop and shut down the timer in dwc2_hcd_release(), before the HCD
resources are freed.  This covers both the HCD initialization error path
and normal HCD removal.

## Affected

- `Linux >= 7359d482eb4d3967cc8be354405ae6be6eaf732c < 82cc242da6d621752718929e6a2fa6f9554ebffe`
- `Linux >= 7359d482eb4d3967cc8be354405ae6be6eaf732c < 441be312fce927443eae2821f502344d953c38bb`
- `Linux >= 7359d482eb4d3967cc8be354405ae6be6eaf732c < 4333174ea52c863a50bb3e0a4726bf9f7cdf7524`
- `Linux >= 7359d482eb4d3967cc8be354405ae6be6eaf732c < 79ba37dd38a321cb32a79332a3e3c68dd334dca9`
- `Linux >= 7359d482eb4d3967cc8be354405ae6be6eaf732c < fd772af9512cdecb83de34a461801533828e77fd`
- `Linux 3.10`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10 · no fix planned: Red Hat Enterprise Linux 10 · updated 2026-10-21 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98762.json)