CVE-2026-98763

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

usb: core: clear both ep_in and ep_out for non-ep0 control endpoints

In usb_enable_endpoint(), non-zero control endpoints (where

usb_endpoint_xfer_control(&ep->desc) is true) populate both

dev->ep_in[epnum] and dev->ep_out[epnum] with the same struct

usb_host_endpoint pointer.

However, usb_disable_endpoint() only clears either dev->ep_out[epnum] or

dev->ep_in[epnum] depending on the direction bit of epaddr when

reset_hardware is set, leaving the opposite direction's array slot

pointing to the disabled/freed endpoint.

Clear both dev->ep_out[epnum] and dev->ep_in[epnum] when disabling a

non-ep0 control endpoint with reset_hardware set, and update the

function kerneldoc accordingly.

Tested in QEMU against Linux 7.3.0-rc3 using dummy_hcd and raw-gadget to

enumerate a USB device with a non-zero control endpoint

(bEndpointAddress 0x01, bmAttributes USB_ENDPOINT_XFER_CONTROL),

verifying that both dev->ep_in[1] and dev->e

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References