---
id: CVE-2026-98765
title: >-
  kernel: USB: gadget: dummy-hcd: Fix wait for outstanding request completions
  (CVE-2026-98765)
summary: >-
  A flaw was found in the Linux kernel's USB dummy Host Controller Driver
  (dummy-hcd). This vulnerability occurs because the driver fails to properly
  wait for active request completion callbacks before unbinding or unloading the
  module. A lo…
severity: medium
cvss: 4.1
cvssVector: 'CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H'
cvssSource: vendor
cwe: CWE-366
vendor: Red Hat
product: Linux
affected:
  - >-
    Linux >= 7dbd8f4cabd96db5a50513de9d83a8105a5ffc81 <
    6849e51b89de5b6fc7447dc8e612b58df19c7dea
  - >-
    Linux >= 7dbd8f4cabd96db5a50513de9d83a8105a5ffc81 <
    7ce4dca0d53b1c3cb2b7e7bb2e42bf5db860caf2
  - >-
    Linux >= 7dbd8f4cabd96db5a50513de9d83a8105a5ffc81 <
    5298c96bf0068f3160969f7ddad81976d01a9b66
  - >-
    Linux >= 7dbd8f4cabd96db5a50513de9d83a8105a5ffc81 <
    3070806a7bc7bb36ed04a21022c09dafcc5619f4
  - >-
    Linux >= 7dbd8f4cabd96db5a50513de9d83a8105a5ffc81 <
    b263ff9b0fc5c1f371d65c4eb196b31263d039ff
  - Linux 7b416b9dac6ede26d4ca0c1a88b448b543623ff3
  - Linux 8590bc1da625dd4a589eac0fc3aa3cf4f400424d
  - Linux a867d5b932ac4911d3f8a1e63505061b0c81f889
  - Linux e84b4a008365b7edbd842a063ae28d040a98db25
  - Linux e39b17143a5b5aac81f066d455e5d3a9877eb3ae
  - Linux 4f8ae1fcb0dfbb72a7678f81bf01fb7fc85c6715
  - Linux >= 3.2.97 < 3.3
  - Linux >= 3.16.52 < 3.17
  - Linux >= 4.1.46 < 4.2
  - Linux >= 4.4.92 < 4.5
  - Linux >= 4.9.55 < 4.10
  - Linux >= 4.13.6 < 4.14
  - Linux 4.14
published: '2026-10-18'
updated: '2026-10-23'
sourceUpdated: '2026-10-23T05:43:35+00:00'
source: CSAF
sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98765.json'
references:
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98765.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-98765'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2555098'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-98765'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-98765'
  - url: >-
      https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98765.mbox
  - url: 'https://git.kernel.org/stable/c/6849e51b89de5b6fc7447dc8e612b58df19c7dea'
  - url: 'https://git.kernel.org/stable/c/7ce4dca0d53b1c3cb2b7e7bb2e42bf5db860caf2'
  - url: 'https://git.kernel.org/stable/c/5298c96bf0068f3160969f7ddad81976d01a9b66'
  - url: 'https://git.kernel.org/stable/c/3070806a7bc7bb36ed04a21022c09dafcc5619f4'
  - url: 'https://git.kernel.org/stable/c/b263ff9b0fc5c1f371d65c4eb196b31263d039ff'
tags:
  - csaf
  - vex
  - red-hat
  - cve.org
epss: 0.00168
epssPercentile: 0.05971
ingestedAt: '2026-10-18T16:47:32.496Z'
---

## Overview

A flaw was found in the Linux kernel's USB dummy Host Controller Driver (dummy-hcd). This vulnerability occurs because the driver fails to properly wait for active request completion callbacks before unbinding or unloading the module. A local attacker could trigger this race condition, leading to invalid memory access and causing a kernel crash that results in a Denial of Service (DoS).

## Vendor advisories

- **Red Hat VEX** · Moderate · updated 2026-10-23 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98765.json)

**kernel: USB: gadget: dummy-hcd: Fix wait for outstanding request completions** — rated Moderate by Red Hat. Released 2026-10-18, updated 2026-10-23.

Not affected:

- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat OpenShift Container Platform 4

## Remediation

Refer to the advisory for fix availability.