{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.113-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.2.10-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  usb: core: clear both ep_in and ep_out for non-ep0 control endpoints  In usb_enable_endpoint(), non-zero control endpoints (where usb_endpoint_xfer_control(\u0026ep-\u003edesc) is true) populate both dev-\u003eep_in[epnum] and dev-\u003eep_out[epnum] with the same struct usb_host_endpoint pointer.  However, usb_disable_endpoint() only clears either dev-\u003eep_out[epnum] or dev-\u003eep_in[epnum] depending on the direction bit of epaddr when reset_hardware is set, leaving the opposite direction's array slot pointing to the disabled/freed endpoint.  Clear both dev-\u003eep_out[epnum] and dev-\u003eep_in[epnum] when disabling a non-ep0 control endpoint with reset_hardware set, and update the function kerneldoc accordingly.  Tested in QEMU against Linux 7.3.0-rc3 using dummy_hcd and raw-gadget to enumerate a USB device with a non-zero control endpoint (bEndpointAddress 0x01, bmAttributes USB_ENDPOINT_XFER_CONTROL), verifying that both dev-\u003eep_in[1] and dev-\u003eep_out[1] are cleared when the interface is disabled.",
  "id": "DEBIAN-CVE-2026-98763",
  "modified": "2026-10-19T04:47:45.632757883Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-98763"
    }
  ],
  "upstream": [
    "CVE-2026-98763"
  ]
}