CVE-2026-98762

A teardown race exists because dwc2_wakeup_detected can access DWC2 host state and rearm the wakeup timer while dwc2_hcd_free is releasing host owned resources. The previous timer deletion did not synchronize with a running callback and did not prevent that callback from queuing the timer again. This creates a potential use after free that can cause a kernel crash and local denial of service. For the CVSS the PR:L value is used for the paranoid score because reduced capability root, a device management service, or a container with delegated driver control may be able to initiate the relevant HCD teardown without having unrestricted host root privileges. The realistic base case is PR:H because driver unbind, module removal, and normal HCD removal are generally administrator controlled. The issue is not network reachable. A connected USB device may influence wakeup activity, but the available code does not prove that an external device alone can reliably initiate HCD teardown. Impact is at least a local denial of service via kernel crash and in the worst case may allow confidentiality or integrity impact due to the potential use after free and should be reviewed manually.