CVE-2026-98767

usb: dwc3: gadget: fix IRQ storm on invalid event buffer count

State: Published
Severity: Not scored
Published: Oct 18, 2026
Updated: Oct 30, 2026
Reserved: Sep 25, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

usb: dwc3: gadget: fix IRQ storm on invalid event buffer count

When dwc3_check_event_buf() reads a GEVNTCOUNT value exceeding the event buffer length, commit 63ccd26cd1f6 ("usb: dwc3: gadget: check that event count does not exceed event buffer length") returns IRQ_NONE without writing back GEVNTCOUNT. Since the DWC3 interrupt is level-triggered, the uncleared IRQ source keeps the line asserted, causing a tight IRQ storm that accumulates 99,900 unhandled interrupts and triggers spurious.c:184 BUG -> kernel panic.

The resulting call stack: __report_bad_irq+0xac/0xc8 note_interrupt+0x340/0x468 handle_irq_event+0xac/0xc0 handle_fasteoi_irq+0x120/0x228 gic_handle_irq+0x68/0x108 ... kernel BUG at kernel/irq/spurious.c:184

To reproduce, write a bogus value exceeding the event buffer length directly to the GEVNTCOUNT register:

devmem <DWC3_BASE + 0xc40c> 4 0x1004

Write the bogus count back to GEVNTCOUNT to clear the IRQ source, consistent with the stale event clearing pattern in dwc3_event_buffers_setup(), and schedule error recovery to reinitialize the controller.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	c0079630f268843a25ed75226169cba40e0d8880 to before 2c41e442ff6304532bf369aa618b23c8a474feb4Affected a44547015287a19001384fe94dbff84c92ce4ee1 to before 86b9c867fb061a147df05ff0d9bb69dd3d79f49aAffected c4d80e41cb42008dceb35e5dbf52574d93beac0d to before 6cd82563bb270e03fe2f91324660ea14e3ce5d1aAffected 52a7c9d930b95aa8b1620edaba4818040c32631f to before 96918ca25ff467c25675478fc79393df4ae9d74cAffected 63ccd26cd1f6600421795f6ca3e625076be06c9f to before ba927133b301894e7d24099afbb701887c8cd2f1Affected 63ccd26cd1f6600421795f6ca3e625076be06c9f to before f51cadb02b439850ab411df0a2cf4288a66d42e2Affected 63ccd26cd1f6600421795f6ca3e625076be06c9f to before 1ff77cbefe5a653ea12874c213ea4bd0d72c1067Affected 015c39f38e69a491d2abd5e98869a500a9459b3bAffected b43225948b231b3f331194010f84512bee4d9f59Affected 99d655119b870ee60e4dbf310aa9a1ed8d9ede3dAffected 5.15.181 to before 5.15.224Affected 6.1.136 to before 6.1.191Affected 6.6.89 to before 6.6.160Affected 6.12.26 to before 6.12.113Affected 5.4.293 to before 5.5Affected 5.10.237 to before 5.11Affected 6.14.5 to before 6.15Affected
LinuxLinux	6.15Affected before 6.15Not affected 5.15.224 through 5.15.Not affected 6.1.191 through 6.1.Not affected 6.6.160 through 6.6.Not affected 6.12.113 through 6.12.Not affected 6.18.56 through 6.18.Not affected 7.2.10 through 7.2.Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

c0079630f268843a25ed75226169cba40e0d8880 to before 2c41e442ff6304532bf369aa618b23c8a474feb4Affected
a44547015287a19001384fe94dbff84c92ce4ee1 to before 86b9c867fb061a147df05ff0d9bb69dd3d79f49aAffected
c4d80e41cb42008dceb35e5dbf52574d93beac0d to before 6cd82563bb270e03fe2f91324660ea14e3ce5d1aAffected
52a7c9d930b95aa8b1620edaba4818040c32631f to before 96918ca25ff467c25675478fc79393df4ae9d74cAffected
63ccd26cd1f6600421795f6ca3e625076be06c9f to before ba927133b301894e7d24099afbb701887c8cd2f1Affected
63ccd26cd1f6600421795f6ca3e625076be06c9f to before f51cadb02b439850ab411df0a2cf4288a66d42e2Affected
63ccd26cd1f6600421795f6ca3e625076be06c9f to before 1ff77cbefe5a653ea12874c213ea4bd0d72c1067Affected
015c39f38e69a491d2abd5e98869a500a9459b3bAffected
b43225948b231b3f331194010f84512bee4d9f59Affected
99d655119b870ee60e4dbf310aa9a1ed8d9ede3dAffected
5.15.181 to before 5.15.224Affected
6.1.136 to before 6.1.191Affected
6.6.89 to before 6.6.160Affected
6.12.26 to before 6.12.113Affected
5.4.293 to before 5.5Affected
5.10.237 to before 5.11Affected
6.14.5 to before 6.15Affected

LinuxLinux

6.15Affected
before 6.15Not affected
5.15.224 through 5.15.*Not affected
6.1.191 through 6.1.*Not affected
6.6.160 through 6.6.*Not affected
6.12.113 through 6.12.*Not affected
6.18.56 through 6.18.*Not affected
7.2.10 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.