Is there a patch available for CVE-2026-98773?

Yes, a patch is available for CVE-2026-98773. Update the affected software to the latest version immediately.

Linux CVE-2026-98773

EUVD-2026-103858

2026-10-18 Linux

GHSA-fp39-rj9v-7xc4

Information Disclosure Linux

View

Monitor Track and reassess. Why: No CVSS yet + weak signal (CWE or non-zero EPSS).

Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisCVE.org

In the Linux kernel, the following vulnerability has been resolved:

USB: cdc-acm: skip URB restart in port_shutdown if disconnected

acm_port_shutdown() is called from the tty-port machinery whenever the last user closes the port. acm_disconnect() sets acm->disconnected and calls tty_port_tty_vhangup(), which eventually triggers port_shutdown(). At that point acm_disconnect() has already called acm_poison_urbs() and is about to free the control and read URBs.

However, acm_port_shutdown() unconditionally calls acm_unpoison_urbs() and, when the ALWAYS_POLL_CTRL quirk is set, immediately re-submits the ctrlurb and all read URBs. If the concurrent acm_disconnect() then frees those URBs and their DMA buffers while they are in-flight, the result is a use-after-free in acm_ctrl_irq() or acm_read_bulk_callback() accessing the freed DMA memory.

Fix by checking acm->disconnected after draining the delayed anchor and returning early: if we are in a disconnect path the URBs must remain poisoned and must not be resubmitted.

The early return is placed after the delayed-anchor drain loop because that loop only cancels write-side accounting (wb->use = false and autopm counter) and does not touch the hardware path.

Affected VersionsENISA

Linux 6.1.175 <6.2

Linux patch: 7.3-rc6

Linux 6.12.83 <6.12.113

Linux 603d5a7110832e10165d21f9a1486399457177de <9742905d9ed5bf23ebe4c100dec80b6bc50fb522

Linux f58752ebcb35e156c85cd1a82d6579c7af3b9023 <dc614d6bc991740d41d5a99ac7765c4b675dda88

Linux 6.6.136 <6.7

Linux 7.1

Linux 6.18.24 <6.18.56

Linux patch: 6.12.113

Linux 5d29d7ff8679e5a525f22da467ba33c042e8029b <a0ed07b5bbb2d8fcef86810453216070691816e7

Linux d826061aa64cb28089bf4c73e301dd7928662b84

Linux f77f10bc76c2da86b4248269472f6d971e37828b

Linux 8fb82e3555a7d56a05d8ef0edee9859f889c0860

Linux 283f8162cc3c82086537cbc7dc01870dbeb07a91

Linux 7.0.1 <7.1

Linux f58752ebcb35e156c85cd1a82d6579c7af3b9023 <420ca35af891d33522cc08504768ccd60a4c450a

Linux patch: 7.2.10

Linux patch: 6.18.56

Linux 6.19.14 <6.20

Linux patch: 0

Affected Packages

euvd linux fix: 6.2, 6.7, 6.12.113, 6.18.56, 6.20, 7.1

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Know when the next one hits your stack

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Lifecycle Timeline

Patch available

Oct 18, 2026 - 17:19 EUVD

CVE Published

Oct 18, 2026 - 15:48 cve.org

UNKNOWN (no severity yet)

Threat Intelligence Overview

EPSS Score

0.2%

Top 94% exploitable

Data Quality

3 sources

Confidence: Low

EUVD

CVE.org

EPSS MSRC

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity Not scored yet

CISA KEV No

Public POC No

EPSS 0.2%

Patch available Yes

Active threat No

Deciding rule

No CVSS yet + weak signal (CWE or non-zero EPSS)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.