---
id: CVE-2026-31758
title: 'usb: usbtmc: Flush anchored URBs in usbtmc_release'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  usb: usbtmc: Flush anchored URBs in usbtmc_release

  When calling usbtmc_release, pending anchored URBs must be flushed or
  killed to prevent use-after-free errors (e.g. …
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 4f3c8d6eddc272b386464524235440a418ed2029 <
    959ef329071136e4335b54822fe2f607659b4569
  - >-
    Linux >= 4f3c8d6eddc272b386464524235440a418ed2029 <
    e189d443767f7cd390c52f2e122e1fc41c7562d6
  - >-
    Linux >= 4f3c8d6eddc272b386464524235440a418ed2029 <
    7fa8f61bab3fb75b5deba8a0f3abb74dc5068d9f
  - >-
    Linux >= 4f3c8d6eddc272b386464524235440a418ed2029 <
    95e09b07e50290254b28b8395509473104518f8c
  - >-
    Linux >= 4f3c8d6eddc272b386464524235440a418ed2029 <
    d13318dec0c1e0e2ac16f8ecbd522db14cea4bb1
  - >-
    Linux >= 4f3c8d6eddc272b386464524235440a418ed2029 <
    977b632db51d231dec0bc571089a5c2402674139
  - >-
    Linux >= 4f3c8d6eddc272b386464524235440a418ed2029 <
    d40198de50232e04c14c6e2092e896766c95ea48
  - >-
    Linux >= 4f3c8d6eddc272b386464524235440a418ed2029 <
    8a768552f7a8276fb9e01d49773d2094ace7c8f1
  - Linux 4.19
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T15:13:00.464457Z'
published: '2026-05-01'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:20:26.197Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-31758'
references:
  - url: 'https://git.kernel.org/stable/c/959ef329071136e4335b54822fe2f607659b4569'
  - url: 'https://git.kernel.org/stable/c/e189d443767f7cd390c52f2e122e1fc41c7562d6'
  - url: 'https://git.kernel.org/stable/c/7fa8f61bab3fb75b5deba8a0f3abb74dc5068d9f'
  - url: 'https://git.kernel.org/stable/c/95e09b07e50290254b28b8395509473104518f8c'
  - url: 'https://git.kernel.org/stable/c/d13318dec0c1e0e2ac16f8ecbd522db14cea4bb1'
  - url: 'https://git.kernel.org/stable/c/977b632db51d231dec0bc571089a5c2402674139'
  - url: 'https://git.kernel.org/stable/c/d40198de50232e04c14c6e2092e896766c95ea48'
  - url: 'https://git.kernel.org/stable/c/8a768552f7a8276fb9e01d49773d2094ace7c8f1'
tags:
  - cve.org
epss: 0.00171
epssPercentile: 0.06044
ingestedAt: '2026-10-16T17:24:46.675Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

usb: usbtmc: Flush anchored URBs in usbtmc_release

When calling usbtmc_release, pending anchored URBs must be flushed or
killed to prevent use-after-free errors (e.g. in the HCD giveback
path). Call usbtmc_draw_down() to allow anchored URBs to be completed.

## Affected

- `Linux >= 4f3c8d6eddc272b386464524235440a418ed2029 < 959ef329071136e4335b54822fe2f607659b4569`
- `Linux >= 4f3c8d6eddc272b386464524235440a418ed2029 < e189d443767f7cd390c52f2e122e1fc41c7562d6`
- `Linux >= 4f3c8d6eddc272b386464524235440a418ed2029 < 7fa8f61bab3fb75b5deba8a0f3abb74dc5068d9f`
- `Linux >= 4f3c8d6eddc272b386464524235440a418ed2029 < 95e09b07e50290254b28b8395509473104518f8c`
- `Linux >= 4f3c8d6eddc272b386464524235440a418ed2029 < d13318dec0c1e0e2ac16f8ecbd522db14cea4bb1`
- `Linux >= 4f3c8d6eddc272b386464524235440a418ed2029 < 977b632db51d231dec0bc571089a5c2402674139`
- `Linux >= 4f3c8d6eddc272b386464524235440a418ed2029 < d40198de50232e04c14c6e2092e896766c95ea48`
- `Linux >= 4f3c8d6eddc272b386464524235440a418ed2029 < 8a768552f7a8276fb9e01d49773d2094ace7c8f1`
- `Linux 4.19`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.