---
id: CVE-2026-98762
title: 'USB: dwc2: shut down wakeup timer before freeing HCD state'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  USB: dwc2: shut down wakeup timer before freeing HCD state

  dwc2_wakeup_detected() accesses the DWC2 host state and can rearm the
  wakeup timer.  dwc2_hcd_free() current…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 7359d482eb4d3967cc8be354405ae6be6eaf732c <
    441be312fce927443eae2821f502344d953c38bb
  - >-
    Linux >= 7359d482eb4d3967cc8be354405ae6be6eaf732c <
    4333174ea52c863a50bb3e0a4726bf9f7cdf7524
  - >-
    Linux >= 7359d482eb4d3967cc8be354405ae6be6eaf732c <
    79ba37dd38a321cb32a79332a3e3c68dd334dca9
  - >-
    Linux >= 7359d482eb4d3967cc8be354405ae6be6eaf732c <
    fd772af9512cdecb83de34a461801533828e77fd
  - Linux 3.10
published: '2026-10-18'
updated: '2026-10-18'
sourceUpdated: '2026-10-18T15:47:53.656Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-98762'
references:
  - url: 'https://git.kernel.org/stable/c/441be312fce927443eae2821f502344d953c38bb'
  - url: 'https://git.kernel.org/stable/c/4333174ea52c863a50bb3e0a4726bf9f7cdf7524'
  - url: 'https://git.kernel.org/stable/c/79ba37dd38a321cb32a79332a3e3c68dd334dca9'
  - url: 'https://git.kernel.org/stable/c/fd772af9512cdecb83de34a461801533828e77fd'
tags:
  - cve.org
ingestedAt: '2026-10-18T16:47:32.495Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

USB: dwc2: shut down wakeup timer before freeing HCD state

dwc2_wakeup_detected() accesses the DWC2 host state and can rearm the
wakeup timer.  dwc2_hcd_free() currently deletes the timer only after
freeing host-owned state, and timer_delete() does not synchronize a
callback or prevent it from being queued again.

Stop and shut down the timer in dwc2_hcd_release(), before the HCD
resources are freed.  This covers both the HCD initialization error path
and normal HCD removal.

## Affected

- `Linux >= 7359d482eb4d3967cc8be354405ae6be6eaf732c < 441be312fce927443eae2821f502344d953c38bb`
- `Linux >= 7359d482eb4d3967cc8be354405ae6be6eaf732c < 4333174ea52c863a50bb3e0a4726bf9f7cdf7524`
- `Linux >= 7359d482eb4d3967cc8be354405ae6be6eaf732c < 79ba37dd38a321cb32a79332a3e3c68dd334dca9`
- `Linux >= 7359d482eb4d3967cc8be354405ae6be6eaf732c < fd772af9512cdecb83de34a461801533828e77fd`
- `Linux 3.10`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.