{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98768", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.369Z", "datePublished": "2026-10-18T15:48:03.089Z", "dateUpdated": "2026-10-30T12:39:37.620Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:39:37.620Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: typec: anx7411 - stop the IRQ before destroying the workqueue\n\nThe IRQ is devm-managed, so it can still queue plat->work while\nremove() is tearing the queue down. Disable it first."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/usb/typec/anx7411.c"], "versions": [{"version": "fe6d8a9c8e6456f8e7ba6b4ee528460beaf65a71", "lessThan": "3deed12f7b54a52879eb7b3f94d9f132c0144401", "status": "affected", "versionType": "git"}, {"version": "fe6d8a9c8e6456f8e7ba6b4ee528460beaf65a71", "lessThan": "a789838675afa3aa174e744f3cef508cd27e7bb1", "status": "affected", "versionType": "git"}, {"version": "fe6d8a9c8e6456f8e7ba6b4ee528460beaf65a71", "lessThan": "675056e0edb49c0002ebfbc289e6c777bbf315a2", "status": "affected", "versionType": "git"}, {"version": "fe6d8a9c8e6456f8e7ba6b4ee528460beaf65a71", "lessThan": "50a92c02551c10e308caa55f7045f31abcef511f", "status": "affected", "versionType": "git"}, {"version": "fe6d8a9c8e6456f8e7ba6b4ee528460beaf65a71", "lessThan": "cb6bf2c707805211f606fb1e06fe28d9affe5ea7", "status": "affected", "versionType": "git"}, {"version": "fe6d8a9c8e6456f8e7ba6b4ee528460beaf65a71", "lessThan": "469600d5d292b1482c90dd6853555821d11b8c5f", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/usb/typec/anx7411.c"], "versions": [{"version": "6.0", "status": "affected"}, {"version": "0", "lessThan": "6.0", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.191", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.160", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.113", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.56", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.10", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0", "versionEndExcluding": "6.1.191"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0", "versionEndExcluding": "6.6.160"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0", "versionEndExcluding": "6.12.113"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0", "versionEndExcluding": "6.18.56"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0", "versionEndExcluding": "7.2.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/3deed12f7b54a52879eb7b3f94d9f132c0144401"}, {"url": "https://git.kernel.org/stable/c/a789838675afa3aa174e744f3cef508cd27e7bb1"}, {"url": "https://git.kernel.org/stable/c/675056e0edb49c0002ebfbc289e6c777bbf315a2"}, {"url": "https://git.kernel.org/stable/c/50a92c02551c10e308caa55f7045f31abcef511f"}, {"url": "https://git.kernel.org/stable/c/cb6bf2c707805211f606fb1e06fe28d9affe5ea7"}, {"url": "https://git.kernel.org/stable/c/469600d5d292b1482c90dd6853555821d11b8c5f"}], "title": "usb: typec: anx7411 - stop the IRQ before destroying the workqueue", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/usb/typec/anx7411.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "3deed12f7b54a52879eb7b3f94d9f132c0144401", "status": "affected", "version": "fe6d8a9c8e6456f8e7ba6b4ee528460beaf65a71", "versionType": "git"}, {"lessThan": "a789838675afa3aa174e744f3cef508cd27e7bb1", "status": "affected", "version": "fe6d8a9c8e6456f8e7ba6b4ee528460beaf65a71", "versionType": "git"}, {"lessThan": "675056e0edb49c0002ebfbc289e6c777bbf315a2", "status": "affected", "version": "fe6d8a9c8e6456f8e7ba6b4ee528460beaf65a71", "versionType": "git"}, {"lessThan": "50a92c02551c10e308caa55f7045f31abcef511f", "status": "affected", "version": "fe6d8a9c8e6456f8e7ba6b4ee528460beaf65a71", "versionType": "git"}, {"lessThan": "cb6bf2c707805211f606fb1e06fe28d9affe5ea7", "status": "affected", "version": "fe6d8a9c8e6456f8e7ba6b4ee528460beaf65a71", "versionType": "git"}, {"lessThan": "469600d5d292b1482c90dd6853555821d11b8c5f", "status": "affected", "version": "fe6d8a9c8e6456f8e7ba6b4ee528460beaf65a71", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/usb/typec/anx7411.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.0"}, {"lessThan": "6.0", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.191", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.160", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.113", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.56", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.10", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: typec: anx7411 - stop the IRQ before destroying the workqueue\n\nThe IRQ is devm-managed, so it can still queue plat->work while\nremove() is tearing the queue down. Disable it first."}], "id": "CVE-2026-98768", "lastModified": "2026-10-30T13:21:26.500", "metrics": {}, "published": "2026-10-18T16:17:30.683", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/3deed12f7b54a52879eb7b3f94d9f132c0144401"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/469600d5d292b1482c90dd6853555821d11b8c5f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/50a92c02551c10e308caa55f7045f31abcef511f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/675056e0edb49c0002ebfbc289e6c777bbf315a2"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a789838675afa3aa174e744f3cef508cd27e7bb1"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/cb6bf2c707805211f606fb1e06fe28d9affe5ea7"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: kernel: Denial of Service via race condition during ANX7411 driver removal", "id": "2555084", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2555084"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.7", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-416", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nusb: typec: anx7411 - stop the IRQ before destroying the workqueue\nThe IRQ is devm-managed, so it can still queue plat->work while\nremove() is tearing the queue down. Disable it first.", "A flaw was found in the Linux kernel's ANX7411 USB Type-C driver. This flaw allows a Denial of Service (DoS) due to a race condition during device removal. Because an interrupt request (IRQ) remains active while the driver destroys its work queue, an incoming interrupt during teardown can trigger a system crash."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2026-98768", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}], "public_date": "2026-10-18T15:48:03Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98768\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98768\nhttps://git.kernel.org/stable/c/469600d5d292b1482c90dd6853555821d11b8c5f\nhttps://git.kernel.org/stable/c/50a92c02551c10e308caa55f7045f31abcef511f\nhttps://git.kernel.org/stable/c/675056e0edb49c0002ebfbc289e6c777bbf315a2\nhttps://git.kernel.org/stable/c/cb6bf2c707805211f606fb1e06fe28d9affe5ea7"], "statement": "A lifecycle race in the anx7411 Type C driver allows the devm managed IRQ to queue plat work while anx7411_i2c_remove() is cancelling work and destroying the associated workqueue. A late interrupt can therefore submit work through a stale workqueue pointer, creating a potential use-after-free that may corrupt workqueue state or crash the kernel. Reliable triggering requires an IRQ to occur inside the narrow driver teardown window, so the attack complexity is high. For the CVSS the PR:L value is used for the paranoid score because a locally constrained user may be able to influence Type C activity or operate through delegated device management while teardown is initiated by another system component. The normal administrative unbind path instead supports PR:H for the base score. The issue is not network reachable, although a connected Type C or USB PD device may influence interrupt timing. Impact is at least a local denial of service via kernel crash and in the worst case may allow confidentiality or integrity impact due to potential use-after-free memory corruption.", "threat_severity": "Moderate"}