---
id: CVE-2026-98767
title: >-
  kernel: usb: dwc3: gadget: fix IRQ storm on invalid event buffer count
  (CVE-2026-98767)
summary: >-
  A flaw was found in the Linux kernel's DWC3 USB gadget driver. When an invalid
  event buffer count exceeding the buffer size is encountered, the driver fails
  to acknowledge and clear the hardware interrupt source before returning. This
  leav…
severity: medium
cvss: 5.1
cvssVector: 'CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H'
cvssSource: vendor
cwe: CWE-390
vendor: Red Hat
product: Red Hat Enterprise Linux 9
affected:
  - enterprise_linux 10
  - enterprise_linux 9
  - openshift_container_platform 4
published: '2026-10-18'
updated: '2026-10-23'
sourceUpdated: '2026-10-23T06:41:05+00:00'
source: CSAF
sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98767.json'
references:
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98767.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-98767'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2555069'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-98767'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-98767'
  - url: >-
      https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98767.mbox
  - url: 'https://git.kernel.org/stable/c/6cd82563bb270e03fe2f91324660ea14e3ce5d1a'
  - url: 'https://git.kernel.org/stable/c/96918ca25ff467c25675478fc79393df4ae9d74c'
  - url: 'https://git.kernel.org/stable/c/ba927133b301894e7d24099afbb701887c8cd2f1'
  - url: 'https://git.kernel.org/stable/c/f51cadb02b439850ab411df0a2cf4288a66d42e2'
  - url: 'https://git.kernel.org/stable/c/1ff77cbefe5a653ea12874c213ea4bd0d72c1067'
tags:
  - csaf
  - vex
  - red-hat
  - cve.org
epss: 0.00168
epssPercentile: 0.05982
ingestedAt: '2026-10-18T16:47:32.494Z'
---

## Overview

A flaw was found in the Linux kernel's DWC3 USB gadget driver. When an invalid event buffer count exceeding the buffer size is encountered, the driver fails to acknowledge and clear the hardware interrupt source before returning. This leaves the interrupt line continuously asserted, triggering an interrupt request (IRQ) storm of unhandled interrupts. This condition ultimately causes a kernel panic, resulting in a system Denial of Service (DoS).

## Vendor advisories

- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · updated 2026-10-23 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98767.json)

**kernel: usb: dwc3: gadget: fix IRQ storm on invalid event buffer count** — rated Moderate by Red Hat. Released 2026-10-18, updated 2026-10-23.

Affected:

- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 9
- Red Hat OpenShift Container Platform 4

No fix planned:

- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 9
- Red Hat OpenShift Container Platform 4

Not affected:

- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
- Red Hat OpenShift Container Platform 4

## Remediation

Fix deferred