CVE-2026-98773

In the Linux kernel, the following vulnerability has been resolved:

USB: cdc-acm: skip URB restart in port shutdown if disconnected

acm port shutdown() is called from the tty-port machinery whenever the last user closes the port. acm disconnect() sets acm->disconnected and calls tty port tty vhangup(), which eventually triggers port shutdown(). At that point acm disconnect() has already called acm poison urbs() and is about to free the control and read URBs.

However, acm port shutdown() unconditionally calls acm unpoison urbs() and, when the ALWAYS POLL CTRL quirk is set, immediately re-submits the ctrlurb and all read URBs. If the concurrent acm disconnect() then frees those URBs and their DMA buffers while they are in-flight, the result is a use-after-free in acm ctrl irq() or acm read bulk callback() accessing the freed DMA memory.

Fix by checking acm->disconnected after draining the delayed anchor and returning early: if we are in a disconnect path the URBs must remain poisoned and must not be resubmitted.

The early return is placed after the delayed-anchor drain loop because that loop only cancels write-side accounting (wb->use = false and autopm counter) and does not touch the hardware path.