# CVE-2026-98767: usb: dwc3: gadget: fix IRQ storm on invalid event buffer count

CVE-2026-98767 is fixed in 2 products on 1 platform, first by DEBIAN-CVE-2026-98767, released October 19, 2026. It is not reported as exploited. Patch Radar priority: Routine.

- Web page: https://patchblox.com/security/cve/CVE-2026-98767
- Priority: Routine
- CVSS: 4.4 (Moderate)
- EPSS: 0.0017
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Oct 18, 2026
- Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-98767

## Description

In the Linux kernel, the following vulnerability has been resolved:  usb: dwc3: gadget: fix IRQ storm on invalid event buffer count  When dwc3_check_event_buf() reads a GEVNTCOUNT value exceeding the event buffer length, commit 63ccd26cd1f6 ("usb: dwc3: gadget: check that event count does not exceed event buffer length") returns IRQ_NONE without writing back GEVNTCOUNT. Since the DWC3 interrupt is level-triggered, the uncleared IRQ source keeps the line asserted, causing a tight IRQ storm that accumulates 99,900 unhandled interrupts and triggers spurious.c:184 BUG -> kernel panic.  The resulting call stack:   __report_bad_irq+0xac/0xc8   note_interrupt+0x340/0x468   handle_irq_event+0xac/0xc0   handle_fasteoi_irq+0x120/0x228   gic_handle_irq+0x68/0x108   ...   kernel BUG at kernel/irq/spurious.c:184  To reproduce, write a bogus value exceeding the event buffer length directly to the GEVNTCOUNT register:    devmem <DWC3_BASE + 0xc40c> 4 0x1004  Write the bogus count back to GEVNTCOUNT to clear the IRQ source, consistent with the stale event clearing pattern in dwc3_event_buffers_setup(), and schedule error recovery to reinitialize the controller.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | linux Debian 13.5 (trixie) | 6.12.113-1 | [DEBIAN-CVE-2026-98767](https://patchblox.com/security/data/fix/linux/debian-cve-2026-98767.md) | Oct 19, 2026 |
| Linux | linux Debian 14 | 7.2.10-1 | [DEBIAN-CVE-2026-98767](https://patchblox.com/security/data/fix/linux/debian-cve-2026-98767.md) | Oct 19, 2026 |
| Linux | linux-6.12 Debian 12.15 (bookworm) | 6.12.113-1~deb12u1 | [DEBIAN-CVE-2026-98767](https://patchblox.com/security/data/fix/linux/debian-cve-2026-98767.md) | Oct 19, 2026 |

---

Data as of 2026-11-08T13:06:02Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.