Riskcovery

CVE-2026-97483

usb: core: hcd: fix possible deadlock in rh control transfers

State
Published
Severity
Not scored
Published
Sep 24, 2026
Updated
Oct 3, 2026
Reserved
Sep 24, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

usb: core: hcd: fix possible deadlock in rh control transfers

>From within the SCSI error handler memory allocations must not trigger IO. Handling errors in UAS and the storage driver may involve resetting a device. The thread doing the reset itself relies on VM magic. However, that is insufficient, as resetting a device involves resuming it. Resumption as well as resetting involves conrol transfers to the parent of the device to be reset. That may be a root hub. Hence usbcore must heed the flags passed to usb_submit_urb() processing control transfers to root hubs.

The problem exist since the storage driver has been merged.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • e57e780b346a7277fdd3bde765d9d8728b99bfa1 to before 8461eda5af77c44d216cec66455bd5b01ee35c9aAffected
  • e57e780b346a7277fdd3bde765d9d8728b99bfa1 to before 8f82fc3d72e5feb7a1efae94b51b431c5bf41c86Affected
  • e57e780b346a7277fdd3bde765d9d8728b99bfa1 to before 936b08d87c667031725bcc753007e7c1182548c6Affected
  • e57e780b346a7277fdd3bde765d9d8728b99bfa1 to before d0291fb4d91982d9f6a680bf759ff0555d351ecbAffected
  • e57e780b346a7277fdd3bde765d9d8728b99bfa1 to before fff917c85d37a294397c5440a795591ca9d6b602Affected
  • e57e780b346a7277fdd3bde765d9d8728b99bfa1 to before 549672a3fb6b36ea408238f89ecf9f41d2da6225Affected
  • e57e780b346a7277fdd3bde765d9d8728b99bfa1 to before d5559f43d76b398392b26a15cbc16d731969cd1cAffected
LinuxLinux
  • 3.12Affected
  • before 3.12Not affected
  • 5.10.271 through 5.10.*Not affected
  • 5.15.222 through 5.15.*Not affected
  • 6.1.189 through 6.1.*Not affected
  • 6.6.158 through 6.6.*Not affected
  • 6.12.111 through 6.12.*Not affected
  • 6.18.53 through 6.18.*Not affected
  • 7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.