{"id":"CVE-2026-98763","aliases":[],"cve":{"records":[{"id":"CVE-2026-98763","source":"Linux","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-09-25T10:25:14.368Z","published":"2026-10-18T15:47:54.526Z","modified":"2026-10-30T12:39:32.238Z"}],"publishers":[{"name":"Linux","role":"CNA","organizationId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","modified":"2026-10-30T12:39:32.238Z"}],"references":[{"url":"https://git.kernel.org/stable/c/59d2c9d70fa42e2290ff68e6430d38a1c817fcb7","tags":[],"source":"Linux"},{"url":"https://git.kernel.org/stable/c/a7928ad4bbb330dfb0f726166384f319d66eb5d1","tags":[],"source":"Linux"},{"url":"https://git.kernel.org/stable/c/b521fe45e06b3f7042e6d1f9566ddb6f179dcb1d","tags":[],"source":"Linux"},{"url":"https://git.kernel.org/stable/c/198d74dcfa129523125f46a89479d3b446b17dbe","tags":[],"source":"Linux"},{"url":"https://git.kernel.org/stable/c/7a9f61476b0e8002092a52ee8295edeeb0a28d1e","tags":[],"source":"Linux"},{"url":"https://git.kernel.org/stable/c/1da16c46b8d7101b74bc2d72a04e23cf5c7ddea1","tags":[],"source":"Linux"},{"url":"https://git.kernel.org/stable/c/c50413ecb662ea43c7f487632c8114721743a277","tags":[],"source":"Linux"},{"url":"https://git.kernel.org/stable/c/0e8baa78d872f2db440d8b9ded946ab8dceb89eb","tags":[],"source":"Linux"}],"weaknesses":[],"applicability":[{"source":"Linux","statements":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.12","versionEndExcluding":"5.10.273"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.12","versionEndExcluding":"5.15.224"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.12","versionEndExcluding":"6.1.191"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.12","versionEndExcluding":"6.6.160"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.12","versionEndExcluding":"6.12.113"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.12","versionEndExcluding":"6.18.56"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.12","versionEndExcluding":"7.2.10"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.12","versionEndExcluding":"7.3"}]}]}]}],"prioritization":[]},"title":"usb: core: clear both ep_in and ep_out for non-ep0 control endpoints","titleSource":"Linux","descriptionSource":"Linux","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: core: clear both ep_in and ep_out for non-ep0 control endpoints\n\nIn usb_enable_endpoint(), non-zero control endpoints (where\nusb_endpoint_xfer_control(&ep->desc) is true) populate both\ndev->ep_in[epnum] and dev->ep_out[epnum] with the same struct\nusb_host_endpoint pointer.\n\nHowever, usb_disable_endpoint() only clears either dev->ep_out[epnum] or\ndev->ep_in[epnum] depending on the direction bit of epaddr when\nreset_hardware is set, leaving the opposite direction's array slot\npointing to the disabled/freed endpoint.\n\nClear both dev->ep_out[epnum] and dev->ep_in[epnum] when disabling a\nnon-ep0 control endpoint with reset_hardware set, and update the\nfunction kerneldoc accordingly.\n\nTested in QEMU against Linux 7.3.0-rc3 using dummy_hcd and raw-gadget to\nenumerate a USB device with a non-zero control endpoint\n(bEndpointAddress 0x01, bmAttributes USB_ENDPOINT_XFER_CONTROL),\nverifying that both dev->ep_in[1] and dev->ep_out[1] are cleared when\nthe interface is disabled.","score":null,"severity":"unknown","published":"2026-10-18T15:47:54.526Z","modified":"2026-10-30T12:39:32.238Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Linux","name":"Linux","platforms":[],"versions":[{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","status":"affected","lessThan":"59d2c9d70fa42e2290ff68e6430d38a1c817fcb7","versionType":"git"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","status":"affected","lessThan":"a7928ad4bbb330dfb0f726166384f319d66eb5d1","versionType":"git"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","status":"affected","lessThan":"b521fe45e06b3f7042e6d1f9566ddb6f179dcb1d","versionType":"git"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","status":"affected","lessThan":"198d74dcfa129523125f46a89479d3b446b17dbe","versionType":"git"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","status":"affected","lessThan":"7a9f61476b0e8002092a52ee8295edeeb0a28d1e","versionType":"git"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","status":"affected","lessThan":"1da16c46b8d7101b74bc2d72a04e23cf5c7ddea1","versionType":"git"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","status":"affected","lessThan":"c50413ecb662ea43c7f487632c8114721743a277","versionType":"git"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","status":"affected","lessThan":"0e8baa78d872f2db440d8b9ded946ab8dceb89eb","versionType":"git"}],"defaultStatus":"unaffected","cpes":[],"source":"Linux","url":"https://www.cve.org/CVERecord?id=CVE-2026-98763"},{"vendor":"Linux","name":"Linux","platforms":[],"versions":[{"version":"2.6.12","status":"affected"},{"version":"0","status":"unaffected","lessThan":"2.6.12","versionType":"semver"},{"version":"5.10.273","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.224","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.191","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.160","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.113","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.56","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.2.10","status":"unaffected","lessThanOrEqual":"7.2.*","versionType":"semver"},{"version":"7.3","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"defaultStatus":"affected","cpes":[],"source":"Linux","url":"https://www.cve.org/CVERecord?id=CVE-2026-98763"}],"remediation":[],"references":["https://git.kernel.org/stable/c/59d2c9d70fa42e2290ff68e6430d38a1c817fcb7","https://git.kernel.org/stable/c/a7928ad4bbb330dfb0f726166384f319d66eb5d1","https://git.kernel.org/stable/c/b521fe45e06b3f7042e6d1f9566ddb6f179dcb1d","https://git.kernel.org/stable/c/198d74dcfa129523125f46a89479d3b446b17dbe","https://git.kernel.org/stable/c/7a9f61476b0e8002092a52ee8295edeeb0a28d1e","https://git.kernel.org/stable/c/1da16c46b8d7101b74bc2d72a04e23cf5c7ddea1","https://git.kernel.org/stable/c/c50413ecb662ea43c7f487632c8114721743a277","https://git.kernel.org/stable/c/0e8baa78d872f2db440d8b9ded946ab8dceb89eb"],"sources":[{"name":"CVE","id":"CVE-2026-98763","modified":"2026-10-30T12:39:32.238Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-98763"}],"assessments":[],"sourceAffected":[],"observedAt":"2026-10-30T13:08:50.381Z","kev":{"status":"not-listed","checkedAt":"2026-11-14T23:30:30.969Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[],"aiSummary":{"text":"The Linux kernel has a vulnerability where disabling a non-ep0 control endpoint only clears one direction's array slot, leaving the other direction's slot pointing to the disabled endpoint. This affects Linux kernel versions prior to 5.10.273, 5.15.224, 6.1.191, 6.6.160, 6.12.113, 6.18.56, 7.2.10, and 7.3. The impact is unclear.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-31T15:46:41.989Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-98763"}]}}