{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.113-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.2.10-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  usb: dwc3: gadget: fix IRQ storm on invalid event buffer count  When dwc3_check_event_buf() reads a GEVNTCOUNT value exceeding the event buffer length, commit 63ccd26cd1f6 (\"usb: dwc3: gadget: check that event count does not exceed event buffer length\") returns IRQ_NONE without writing back GEVNTCOUNT. Since the DWC3 interrupt is level-triggered, the uncleared IRQ source keeps the line asserted, causing a tight IRQ storm that accumulates 99,900 unhandled interrupts and triggers spurious.c:184 BUG -\u003e kernel panic.  The resulting call stack:   __report_bad_irq+0xac/0xc8   note_interrupt+0x340/0x468   handle_irq_event+0xac/0xc0   handle_fasteoi_irq+0x120/0x228   gic_handle_irq+0x68/0x108   ...   kernel BUG at kernel/irq/spurious.c:184  To reproduce, write a bogus value exceeding the event buffer length directly to the GEVNTCOUNT register:    devmem \u003cDWC3_BASE + 0xc40c\u003e 4 0x1004  Write the bogus count back to GEVNTCOUNT to clear the IRQ source, consistent with the stale event clearing pattern in dwc3_event_buffers_setup(), and schedule error recovery to reinitialize the controller.",
  "id": "DEBIAN-CVE-2026-98767",
  "modified": "2026-10-19T04:47:33.363337265Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-98767"
    }
  ],
  "upstream": [
    "CVE-2026-98767"
  ]
}