Executive brief
The Linux kernel's USB gadget UVC (video class) function contains a null pointer dereference in its initialization code. When a kthread worker fails to start, the error handler attempts to access an uninitialized pointer, causing the kernel to crash. This affects systems that use USB gadget UVC functionality, typically embedded devices or systems configured as USB video peripherals.
Technical details
This is a null pointer dereference bug in the uvcg_video_init() function within drivers/usb/gadget/function/uvc_video.c. The vulnerability occurs when kthread_run_worker() fails during initialization. The error logging code attempts to dereference video->uvc->func, but video->uvc is not assigned at that point in the initialization sequence, resulting in a null pointer dereference. The fix is simple: use the already-initialized uvc->func parameter directly instead of the uninitialized video->uvc pointer. The bug was introduced in commit f0bbfbd16b3b and has been fixed by replacing the pointer reference in the error handler.
Affected products
- Linux Linux kernel multiple versions (see Linux kernel stable tree)
Timeline
- 2026-09-11: disclosed
- 2026-08-14: patched