CVE record · CVE-2026-98767

usb: dwc3: gadget: fix IRQ storm on invalid event buffer count

No CVSS scoreEPSS 0.0017 · 6th percentile

Published by the CVE Program (CNA: Linux) at 18 Oct 2026, 15:48 UTC. agentprime has not analysed this yet, so whether it affects any app is not known. This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it.

Affected products, as the CNA wrote them
Vendor	Product	Versions
Linux	Linux	affected c0079630f268843a25ed75226169cba40e0d8880 to before 2c41e442ff6304532bf369aa618b23c8a474feb4 git affected a44547015287a19001384fe94dbff84c92ce4ee1 to before 86b9c867fb061a147df05ff0d9bb69dd3d79f49a git affected c4d80e41cb42008dceb35e5dbf52574d93beac0d to before 6cd82563bb270e03fe2f91324660ea14e3ce5d1a git affected 52a7c9d930b95aa8b1620edaba4818040c32631f to before 96918ca25ff467c25675478fc79393df4ae9d74c git affected 63ccd26cd1f6600421795f6ca3e625076be06c9f to before ba927133b301894e7d24099afbb701887c8cd2f1 git affected 63ccd26cd1f6600421795f6ca3e625076be06c9f to before f51cadb02b439850ab411df0a2cf4288a66d42e2 git affected 63ccd26cd1f6600421795f6ca3e625076be06c9f to before 1ff77cbefe5a653ea12874c213ea4bd0d72c1067 git affected 015c39f38e69a491d2abd5e98869a500a9459b3b git affected b43225948b231b3f331194010f84512bee4d9f59 git affected 99d655119b870ee60e4dbf310aa9a1ed8d9ede3d git affected 5.15.181 to before 5.15.224 semver affected 6.1.136 to before 6.1.191 semver and 5 more Other versions: unaffected
Linux	Linux	affected 6.15 unaffected before 6.15 semver unaffected 5.15.224 to 5.15., inclusive semver unaffected 6.1.191 to 6.1., inclusive semver unaffected 6.6.160 to 6.6., inclusive semver unaffected 6.12.113 to 6.12., inclusive semver unaffected 6.18.56 to 6.18., inclusive semver unaffected 7.2.10 to 7.2., inclusive semver unaffected 7.3 to *, inclusive original_commit_for_fix Other versions: affected

Identifiers: CVE-2026-98767
CNA: Linux
Tags: Linux kernel
Published: 18 Oct 2026
Updated: 30 Oct 2026

Not analysed yet

We haven’t published our own analysis of this CVE. If a person reviews it, this page will say what’s affected and what has to be true for it to matter.

Severity and exploitation

No source has published a CVSS score for this record yet.

CISA KEV Not listed.
EPSS 0.0017, the 6th percentile, on 6 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.

Timeline

This record came from the full history of the CVE Program, published 18 Oct 2026. New records show when each source confirmed them.

Sources

References from the CNA

Facts on this page come from the CVE List as the CNA published them, with CVSS from the sources named above, CISA KEV and FIRST EPSS. Vendors, products and versions are shown as the CNA wrote them. We don’t reproduce the CVE’s description.