SB20261022377 - Improper handling of exceptional conditions in Linux kernel usb dwc3 driver

Description

This security bulletin contains information about 1 vulnerability.

1) Improper handling of exceptional conditions (CVE-ID: CVE-2026-98767)

CWE-ID: CWE-755 - Improper Handling of Exceptional Conditions

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service by triggering an interrupt storm and kernel panic.

The vulnerability exists due to improper handling of an invalid event count in the Linux kernel DWC3 USB gadget driver's dwc3_check_event_buf() function when the GEVNTCOUNT register value exceeds the event buffer length. A local privileged user can write an oversized count directly to GEVNTCOUNT to leave the level-triggered interrupt source asserted, causing repeated unhandled interrupts that trigger a kernel panic.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/1ff77cbefe5a653ea12874c213ea4bd0d72c1067
• https://git.kernel.org/stable/c/6cd82563bb270e03fe2f91324660ea14e3ce5d1a
• https://git.kernel.org/stable/c/96918ca25ff467c25675478fc79393df4ae9d74c
• https://git.kernel.org/stable/c/ba927133b301894e7d24099afbb701887c8cd2f1
• https://git.kernel.org/stable/c/f51cadb02b439850ab411df0a2cf4288a66d42e2