{"id":41239,"date":"2026-10-19T00:32:45","date_gmt":"2026-10-18T16:32:45","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-98767"},"modified":"2026-10-19T00:32:45","modified_gmt":"2026-10-18T16:32:45","slug":"cve-2026-98767","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-98767","title":{"rendered":"CVE-2026-98767 &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\nusb: dwc3: gadget: fi"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>usb: dwc3: gadget: fix IRQ storm on invalid event buffer count<\/p>\n<p>When dwc3_check_event_buf() reads a GEVNTCOUNT value exceeding the<br \/>\nevent buffer length, commit 63ccd26cd1f6 (&#8220;usb: dwc3: gadget: check<br \/>\nthat event count does not exceed event buffer length&#8221;) returns IRQ_NONE<br \/>\nwithout writing back GEVNTCOUNT. Since the DWC3 interrupt is<br \/>\nlevel-triggered, the uncleared IRQ source keeps the line asserted,<br \/>\ncausing a tight IRQ storm that accumulates 99,900 unhandled interrupts<br \/>\nand triggers spurious.c:184 BUG -&gt; kernel panic.<\/p>\n<p>The resulting call stack:<br \/>\n  __report_bad_irq+0xac\/0xc8<br \/>\n  note_interrupt+0x340\/0x468<br \/>\n  handle_irq_event+0xac\/0xc0<br \/>\n  handle_fasteoi_irq+0x120\/0x228<br \/>\n  gic_handle_irq+0x68\/0x108<br \/>\n  &#8230;<br \/>\n  kernel BUG at kernel\/irq\/spurious.c:184<\/p>\n<p>To reproduce, write a bogus value exceeding the event buffer length<br \/>\ndirectly to the GEVNTCOUNT register:<\/p>\n<p>  devmem  4 0x1004<\/p>\n<p>Write the bogus count back to GEVNTCOUNT to clear the IRQ source,<br \/>\nconsistent with the stale event clearing pattern in<br \/>\ndwc3_event_buffers_setup(), and schedule error recovery to<br \/>\nreinitialize the controller.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>usb: dwc3: gadget: fix IRQ storm on invalid event buffer count<\/p>\n<p>When dwc3_check_event_buf() reads a GEVNTCOUNT value exceeding the<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-41239","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/41239","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=41239"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=41239"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=41239"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}