Executive brief
A vulnerability in the Linux kernel's USB driver for Cadence USB3 devices could allow a local user to crash the system. The issue occurs when the system attempts to process data for a USB component that has not been fully set up or has been disabled. This results in a kernel crash, leading to a complete loss of system availability.
Technical details
A NULL pointer dereference exists in the cdns3 gadget driver within the __cdns3_gadget_ep_queue() function in drivers/usb/cdns3/cdns3-gadget.c. The vulnerability is triggered when a gadget endpoint is disabled or not yet configured, leaving the ep->desc pointer as NULL. A local attacker can trigger this condition to cause a kernel oops/crash (Denial of Service). The fix involves adding a check for the NULL descriptor and returning -ESHUTDOWN, which is the standard error code for unconfigured endpoints. Patches have been released for multiple stable kernel branches including 5.15.x, 6.1.x, 6.6.x, 6.12.x, and 6.18.x.
Affected products
- Linux Linux Kernel 5.4 to 6.18.22
Timeline
- 2026-03-31: disclosed: Initial patch submitted by Yongchao Wu
- 2026-04-11: patched: Patch committed to stable trees by Greg Kroah-Hartman
- 2026-05-01: advisory: CVE published by NVD
References
- https://git.kernel.org/stable/c/14bf08ab2cdfcdfd3f13e799d06692a1b3e0745f
- https://git.kernel.org/stable/c/390536cc6af4ca5566bc3bf1f8b704700380cd2c
- https://git.kernel.org/stable/c/3cf0580a09d417eab41ce914a11f9cde3a121871
- https://git.kernel.org/stable/c/3d1433fe34b224b90259e207e5389e95b504ef04
- https://git.kernel.org/stable/c/7f6f127b9bc34bed35f56faf7ecb1561d6b39000
- https://git.kernel.org/stable/c/9ab9b0e5fcdac325f950fc8b6caa08a9e22a0db9
- https://git.kernel.org/stable/c/d61446dfc9d387775bb1b95b081953201b9222af