Junglewise Threat Intelligence

CVE-2026-45911: Linux Kernel cdns3 NULL pointer dereference in USB role switching

CVE-2026-45911 · Severity: info · CVSS 5.5 · Published 2026-05-27

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's USB driver for Cadence USB3 controllers can cause a system crash (kernel panic) when a USB device changes its role (e.g., from device to host) while the system is suspended. This issue occurs during the system wake-up process, leading to a complete loss of availability for the affected machine. This primarily impacts hardware using the cdns3 controller, such as certain Texas Instruments embedded platforms.

Technical details

A NULL pointer dereference exists in the cdns3 USB driver within the Linux kernel's power management resume path. When a USB role switch (e.g., switching to host mode) occurs while the system is suspended, the `cdns_resume` function attempts to call the `resume()` operation for the new role. However, if the new role is 'host', the `xhci-hcd` device registration initiated by the role's `start()` operation is deferred during the resume sequence. The subsequent `cdns_host_resume` call assumes the device has already been probed, resulting in a NULL pointer dereference when accessing the HCD structure. The fix involves skipping the resume operation for the new role if a role switch was detected during the resume process, allowing the device to be properly probed after the resume sequence completes.

Affected products

  • Linux Linux Kernel 6.19.0-rc7-00013-g6e64f4aabfae-dirty

Timeline

  • 2026-01-30: patched: Initial patch submitted by Thomas Richard (TI)
  • 2026-05-27: disclosed: CVE-2026-45911 published

References