CVE-2026-98767

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

usb: dwc3: gadget: fix IRQ storm on invalid event buffer count

When dwc3_check_event_buf() reads a GEVNTCOUNT value exceeding the

event buffer length, commit 63ccd26cd1f6 ("usb: dwc3: gadget: check

that event count does not exceed event buffer length") returns IRQ_NONE

without writing back GEVNTCOUNT. Since the DWC3 interrupt is

level-triggered, the uncleared IRQ source keeps the line asserted,

causing a tight IRQ storm that accumulates 99,900 unhandled interrupts

and triggers spurious.c:184 BUG -> kernel panic.

The resulting call stack:

__report_bad_irq+0xac/0xc8

note_interrupt+0x340/0x468

handle_irq_event+0xac/0xc0

handle_fasteoi_irq+0x120/0x228

gic_handle_irq+0x68/0x108

...

kernel BUG at kernel/irq/spurious.c:184

To reproduce, write a bogus value exceeding the event buffer length

directly to the GEVNTCOUNT register:

devmem <DWC3_BASE + 0xc40c> 4 0x1004

Write the bogus count back to GEVNTCOUNT t

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References