CVE-2026-98766: Software Security Vulnerability Vulnerability

UNKNOWN
Advisory Identifier: GHSA-5m27-6x28-p9v6
Share
Published
Advisory Summary

CVE-2026-98766 is a security vulnerability vulnerability (General Security Weakness) affecting Software libraries in the Maven ecosystem. Remediation is available in the latest vendor maintenance releases.

CVE-2026-98766 at a Glance

CVE Identifier CVE-2026-98766
GHSA Identifier GHSA-5m27-6x28-p9v6
Severity N/A
CVSS v3.1 Base Score N/A
CWE Classification General Security Weakness
Affected Product Software
Package Ecosystem Maven
Published Date
Last Updated

How to Fix CVE-2026-98766

To remediate this vulnerability, upgrade all affected Software dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

mvn dependency:tree

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2026-98766, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree

Analyze the terminal output to locate any version of Software in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.

Note: The mvn dependency:tree command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under General Security Weakness. In Software, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: aspeed-vhub: cancel wake work on device removal wake_work is armed from the gadget .wakeup callback to resume suspended downstream ports, and it is never cancelled in ast_vhub_remove(), so a work item queued before or during removal can run after devm has freed vhub and its ports, a use-after-free. Cancelling the work alone is not sufficient: usb_gadget_wakeup() takes no lock and the unbind path never clears wakeup_en, so a remote-wakeup request in flight on another CPU can re-arm the work after the cancel and before vhub is freed. ast_vhub_del_dev() already clears d->registered under vhub->lock before unregistering the gadget. Refuse the wakeup in ast_vhub_udc_wakeup() once d->registered is clear: the check and the schedule_work() are then atomic against the unbind, so a wakeup that passed before the flag was cleared is drained by the cancel_work_sync() after the del_dev loop, and one that arrives later returns without arming. Also move INIT_WORK() to the top of ast_vhub_probe(), since the probe error path reuses ast_vhub_remove() and would otherwise cancel a never-initialized work item. This issue was found by an in-house static analysis tool.

References

NVD — CVE-2026-98766 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-98766
git.kernel.org/stable/c/20388c8d1d... WEB
https://git.kernel.org/stable/c/20388c8d1d74c203fec8194c45cd31afdfab934e
git.kernel.org/stable/c/474e9e1852... WEB
https://git.kernel.org/stable/c/474e9e1852fb5ba0bfb26f123dd0cb361d0f4f4d
git.kernel.org/stable/c/c81504dfd2... WEB
https://git.kernel.org/stable/c/c81504dfd2d93e345c98e7a012c2f2e74ce5b6a1
git.kernel.org/stable/c/f343bfa3fc... WEB
https://git.kernel.org/stable/c/f343bfa3fc9f6255602d66f4a7dbe7ddef13ba41

Frequently Asked Questions

What is CVE-2026-98766?
CVE-2026-98766 is a security vulnerability in Software classified as a security vulnerability vulnerability under General Security Weakness.
Which Software versions are affected?
Affected versions include releases prior to current release patches.
What version fixes CVE-2026-98766?
Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.
What CWE is associated with CVE-2026-98766?
CVE-2026-98766 is classified under General Security Weakness.
How can I check Maven dependencies for CVE-2026-98766?
Run the dependency tree command: 'mvn dependency:tree'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-5m27-6x28-p9v6",
  "modified" : "2026-10-18T18:32:02Z",
  "published" : "2026-10-18T18:32:02Z",
  "aliases" : [ "CVE-2026-98766" ],
  "details" : "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: aspeed-vhub: cancel wake work on device removal\n\nwake_work is armed from the gadget .wakeup callback to resume suspended\ndownstream ports, and it is never cancelled in ast_vhub_remove(), so a\nwork item queued before or during removal can run after devm has freed\nvhub and its ports, a use-after-free.\n\nCancelling the work alone is not sufficient: usb_gadget_wakeup() takes\nno lock and the unbind path never clears wakeup_en, so a remote-wakeup\nrequest in flight on another CPU can re-arm the work after the cancel\nand before vhub is freed.\n\nast_vhub_del_dev() already clears d->registered under vhub->lock before\nunregistering the gadget. Refuse the wakeup in ast_vhub_udc_wakeup()\nonce d->registered is clear: the check and the schedule_work() are then\natomic against the unbind, so a wakeup that passed before the flag was\ncleared is drained by the cancel_work_sync() after the del_dev loop,\nand one that arrives later returns without arming. Also move INIT_WORK()\nto the top of ast_vhub_probe(), since the probe error path reuses\nast_vhub_remove() and would otherwise cancel a never-initialized work\nitem.\n\nThis issue was found by an in-house static analysis tool.",
  "severity" : [ ],
  "affected" : [ ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-98766"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/20388c8d1d74c203fec8194c45cd31afdfab934e"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/474e9e1852fb5ba0bfb26f123dd0cb361d0f4f4d"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/c81504dfd2d93e345c98e7a012c2f2e74ce5b6a1"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/f343bfa3fc9f6255602d66f4a7dbe7ddef13ba41"
  } ],
  "database_specific" : {
    "cwe_ids" : [ ],
    "severity" : null,
    "github_reviewed" : false,
    "github_reviewed_at" : null,
    "nvd_published_at" : "2026-10-18T16:17:30Z"
  }
}