Investigate in your agent.

Turn this advisory into a focused investigation. Ask your agent to check your project’s versions, explain the evidence, and suggest a compatible fix.

Your agent needs remote MCP support and access to https://cve.new/mcp.

Read the setup guide

Skip to content
cve.newCreate a CVE report
Check your stack
CVE-2026-98933

usb: hub: use shorter 120ms post resume hold for SS root hubs

Products / packages Linux

Published

Share

Severity and exploitation

Not in CISA KEVNo CVSS score

KEV coverage does not rule out exploitation.

KEV checked 14/11/2026, 21:00:34 UTC

Severity

unknown

CVSS measures technical severity, not the likelihood of an attack.

Known exploitation

Not listed in the checked CISA KEV catalog

Absence from CISA KEV does not rule out attacks.

Public exploit

Not established by this record

Missing evidence does not mean no public exploit exists.

Remediation

Fix status not established

No structured fix or guidance is available here. Check the latest publisher advisory.

What this means

In the Linux kernel, the following vulnerability has been resolved:

Source excerpt · Linux

Attack conditions

No attack-condition excerpt has been identified here. Review the full source description and references for authentication, network access, and configuration requirements.

Review supporting sources →

Affected versions

Check the exact model, release, and any platform requirements against your installation.

Linux · Linux

Linux

17 ranges
Linux version evidence

Compare with this publisher’s ranges. This does not inspect your installation.

affected

8aa04df2553f29e6249f978a29421f2744a65ffb → before ff21323b74a876c54b1ebe9e5f8ba5abc7e07fd3

git versions

e38ca702130b7d70834abdbee58135ca471b2106 → before 73d4fbc496935ccaffba15ca5ec33660c2b587fb

git versions

43e53eb8433c332666a222bff8e49aa03a470d0d → before 86e0baedd55fca30081fcd858ab336dfc0f1cc09

git versions

15fea75a788681dd36a869dd90ff4f0461ea0714 → before e4df763ba3c4fdd1d9256f7a75a17ab7c5e31db6

git versions

aec11e5f9c452ef64e2c113637ab89a67a5ceb62 → before 2dc82d6a12050c2c678a328cd29837beb367df7d

git versions

8f5b7e2bec1c36578fdaa74a6951833541103e27 → before e9545dd8bc62596b2a20966be41f39879ea7c8d0

git versions

8f5b7e2bec1c36578fdaa74a6951833541103e27 → before d7c4a49b41583266e1456d40f37966029f61dab9

git versions

8f5b7e2bec1c36578fdaa74a6951833541103e27 → before 29480b05e6e226594dc11ccf2a036fbd5cdd0e42

git versions

042959e9b479502a921109224c3abcc3d3cf09a1

git versions

16840c4e102ee5424ab1c49238f0bbf568d13a1c

git versions

5.10.241 → before 5.10.273

semver versions

5.15.190 → before 5.15.224

semver versions

6.1.147 → before 6.1.191

semver versions

6.6.100 → before 6.6.160

semver versions

6.12.40 → before 6.12.113

semver versions

5.4.297 → before 5.5

semver versions

6.15.8 → before 6.16

semver versions

unaffected

unknown

Other versions: unaffected

Linux · Linux

Linux

10 ranges
Linux version evidence

Compare with this publisher’s ranges. This does not inspect your installation.

affected

6.16

unaffected

0 → before 6.16

semver versions

5.10.273 → through 5.10.*

semver versions

5.15.224 → through 5.15.*

semver versions

6.1.191 → through 6.1.*

semver versions

6.6.160 → through 6.6.*

semver versions

6.12.113 → through 6.12.*

semver versions

6.18.56 → through 6.18.*

semver versions

7.2.10 → through 7.2.*

semver versions

7.3 → through *

original_commit_for_fix versions

unknown

Other versions: affected

Automatic dependency matching is unavailable for this record. Use the product evidence and publisher’s instructions to check your installation.

What to do

Compare your installed product and version with the affected versions above. A matching product name alone does not confirm exposure.

No structured fix or remediation guidance is available here. Check the full source description and vendor’s latest advisory for a patch or workaround; do not assume another version is safe.

cve.new guidance unless attributed to a publisher. This page does not inspect your installation.

Public exploit evidence

No public exploit reference is identified in the imported evidence. This is not a claim that no exploit exists.

Original source description

Read the full publisher description

In the Linux kernel, the following vulnerability has been resolved:

usb: hub: use shorter 120ms post resume hold for SS root hubs

Holding a USB3 hub PM runtime reference for 200ms at hub resume triggers an AMD platform issue. Users running Android adb report crashes after adb has been polling and waking up the USB subsystem once a second for some time. Vendors are working on a solution. Disabling USB runtime PM is one way to prevent this issue, but it is also proven that reducing the hold time to 120ms in resume also mitigates it. See Link for more details.

Reducing the hold time to 120ms for the USB3 roothub is in itself a valid change and optimization, as the current 200ms is excessive: a root hub has no upstream suspended hub whose wake propagation needs to be accounted for, but still need some time for USB3 link training to complete.

Keep the 200ms hold for external hubs that commit 8f5b7e2bec1c ("usb: hub: fix detection of high tier USB3 devices behind suspended hubs") is intended for.

References

8 sources
git.kernel.org/stable/c/ff21323b74a876c54b1ebe9e5f8ba5abc7e07fd3
Source referenceLinux
git.kernel.org/stable/c/73d4fbc496935ccaffba15ca5ec33660c2b587fb
Source referenceLinux
git.kernel.org/stable/c/86e0baedd55fca30081fcd858ab336dfc0f1cc09
Source referenceLinux
git.kernel.org/stable/c/e4df763ba3c4fdd1d9256f7a75a17ab7c5e31db6
Source referenceLinux
git.kernel.org/stable/c/2dc82d6a12050c2c678a328cd29837beb367df7d
Source referenceLinux
git.kernel.org/stable/c/e9545dd8bc62596b2a20966be41f39879ea7c8d0
Source referenceLinux
View 2 more references
git.kernel.org/stable/c/d7c4a49b41583266e1456d40f37966029f61dab9
Source referenceLinux
git.kernel.org/stable/c/29480b05e6e226594dc11ccf2a036fbd5cdd0e42
Source referenceLinux

Inside the record

Evidence available

Package identity · not supplied
Version evidence
Remediation guidance · not supplied
Weakness classification · not supplied
Additional publishers · not supplied

Describes the evidence in this view, not whether the product is safe.

Original records

CVE-2026-98933

View the latest unmodified CVE JSON from the official source. It may be newer than this imported page.

cve.new JSON →

Environment requirements

These conditions apply together as specified by the publisher. A matching product name alone does not establish exposure.

Linux · platform conditions

Any condition may hold

Vulnerable product

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

From (inclusive): 5.10.241

Before: 5.10.273

Vulnerable product

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

From (inclusive): 5.15.190

Before: 5.15.224

Vulnerable product

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

From (inclusive): 6.1.147

Before: 6.1.191

Vulnerable product

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

From (inclusive): 6.6.100

Before: 6.6.160

Vulnerable product

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

From (inclusive): 6.12.40

Before: 6.12.113

Vulnerable product

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

From (inclusive): 6.16

Before: 6.18.56

Vulnerable product

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

From (inclusive): 6.16

Before: 7.2.10

Vulnerable product

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

From (inclusive): 6.16

Before: 7.3

Vulnerable product

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

From (inclusive): 5.4.297

Vulnerable product

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

From (inclusive): 6.15.8

Applicability preview
[
  {
    "nodes": [
      {
        "operator": "OR",
        "negate": false,
        "cpeMatch": [
          {
            "vulnerable": true,
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "versionStartIncluding": "5.10.241",
            "versionEndExcluding": "5.10.273"
          },
          {
            "vulnerable": true,
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "versionStartIncluding": "5.15.190",
            "versionEndExcluding": "5.15.224"
          },
          {
            "vulnerable": true,
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "versionStartIncluding": "6.1.147",
            "versionEndExcluding": "6.1.191"
          },
          {
            "vulnerable": true,
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "versionStartIncluding": "6.6.100",
            "versionEndExcluding": "6.6.160"
          },
          {
            "vulnerable": true,
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "versionStartIncluding": "6.12.40",
            "versionEndExcluding": "6.12.113"
          },
          {
            "vulnerable": true,
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "versionStartIncluding": "6.16",
            "versionEndExcluding": "6.18.56"
          },
          {
            "vulnerable": true,
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "versionStartIncluding": "6.16",
            "versionEndExcluding": "7.2.10"
          },
          {
            "vulnerable": true,
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "versionStartIncluding": "6.16",
            "versionEndExcluding": "7.3"
          },
          {
            "vulnerable": true,
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "versionStartIncluding": "5.4.297"
          },
          {
            "vulnerable": true,
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "versionStartIncluding": "6.15.8"
          }
        ]
      }
    ]
  }
]
Contributing organizations · 1
Linux

Assigning organization

2026-10-30

Timeline

All times UTC

  1. Advisory published

    Publication date supplied by the source.

  2. Source updated

    Latest modification date supplied by the source.

  3. Last imported by cve.new

    Latest catalog import, not the date we first saw this advisory.

What changed

Follow changes
No substantive changes have been recorded here yet. History starts when cve.new observes a change after tracking is enabled; earlier edits are not reconstructed.

Large field values are marked as truncated previews. Original source snapshots remain retained.