Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2026-98763

usb: core: clear both ep_in and ep_out for non-ep0 control endpoints

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: usb: core: clear both ep_in and ep_out for non-ep0 control endpoints In usb_enable_endpoint(), non-zero control endpoints (where usb_endpoint_xfer_control(&ep->desc) is true) populate both dev->ep_in[epnum] and dev->ep_out[epnum] with the same struct usb_host_endpoint pointer. However, usb_disable_endpoint() only clears either dev->ep_out[epnum] or dev->ep_in[epnum] depending on the direction bit of epaddr when reset_hardware is set, leaving the opposite direction's array slot pointing to the disabled/freed endpoint. Clear both dev->ep_out[epnum] and dev->ep_in[epnum] when disabling a non-ep0 control endpoint with reset_hardware set, and update the function kerneldoc accordingly. Tested in QEMU against Linux 7.3.0-rc3 using dummy_hcd and raw-gadget to enumerate a USB device with a non-zero control endpoint (bEndpointAddress 0x01, bmAttributes USB_ENDPOINT_XFER_CONTROL), verifying that both dev->ep_in[1] and dev->ep_out[1] are cleared when the interface is disabled.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 59d2c9d70fa42e2290ff68e6430d38a1c817fcb7affected
  • 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < a7928ad4bbb330dfb0f726166384f319d66eb5d1affected
  • 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < b521fe45e06b3f7042e6d1f9566ddb6f179dcb1daffected
  • 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 198d74dcfa129523125f46a89479d3b446b17dbeaffected
  • 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 7a9f61476b0e8002092a52ee8295edeeb0a28d1eaffected
  • 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 1da16c46b8d7101b74bc2d72a04e23cf5c7ddea1affected
  • 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < c50413ecb662ea43c7f487632c8114721743a277affected
  • 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 0e8baa78d872f2db440d8b9ded946ab8dceb89ebaffected

Linux Linux

Default version status: affected

  • 2.6.12affected
  • 0 to < 2.6.12unaffected
  • 5.10.273 to ≤ 5.10.*unaffected
  • 5.15.224 to ≤ 5.15.*unaffected
  • 6.1.191 to ≤ 6.1.*unaffected
  • 6.6.160 to ≤ 6.6.*unaffected
  • 6.12.113 to ≤ 6.12.*unaffected
  • 6.18.56 to ≤ 6.18.*unaffected
  • 7.2.10 to ≤ 7.2.*unaffected
  • 7.3 to ≤ *unaffected

References