CVE-2026-31754: usb: cdns3: gadget: fix state inconsistency on gadget init failure
In the Linux kernel, the following vulnerability has been resolved:
usb: cdns3: gadget: fix state inconsistency on gadget init failure
When cdns3gadgetstart() fails, the DRD hardware is left in gadget mode while software state remains INACTIVE, creating hardware/software state inconsistency.
When switching to host mode via sysfs: echo host > /sys/class/usbrole/13180000.usb-role-switch/role
The role state is not set to CDNSROLESTATEACTIVE due to the error, so cdnsrolestop() skips cleanup because state is still INACTIVE. This violates the DRD controller design specification (Figure22), which requires returning to idle state before switching roles.
This leads to a synchronous external abort in xhcigensetup() when setting up the host controller:
[ 516.440698] configfs-gadget 13180000.usb: failed to start g1: -19 [ 516.442035] cdns-usb3 13180000.usb: Failed to add gadget [ 516.443278] cdns-usb3 13180000.usb: set role 2 has failed ... [ 1301.375722] xhci-hcd xhci-hcd.1.auto: xHCI Host Controller [ 1301.377716] Internal error: synchronous external abort: 96000010 [#1] PREEMPT SMP [ 1301.382485] pc : xhcigensetup+0xa4/0x408 [ 1301.393391] backtrace: ... xhcigensetup+0xa4/0x408 <-- CRASH xhciplatsetup+0x44/0x58 usbaddhcd+0x284/0x678 ... cdnsroleset+0x9c/0xbc <-- Role switch
Fix by calling cdnsdrdgadgetoff() in the error path to properly clean up the DRD gadget state.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1 - Compensating control
In the cdns3_gadget_start() error path, call cdns_drd_gadget_off() to clean up the DRD gadget state and return the controller to idle before switching roles.
Event History
Frequently Asked Questions
Which systems are exposed to this failure?
Systems using the Linux kernel Cadence USB3 (cdns3) dual-role controller are exposed when gadget startup fails and the controller is subsequently switched to host mode. The described role switch is performed through the USB role sysfs interface.
What conditions trigger the crash?
Gadget initialization must first fail, leaving the hardware in gadget mode while the software state remains INACTIVE. A later switch to host mode can then bypass required cleanup and cause a synchronous external abort during xHCI host-controller setup.
Is there a workaround if the update cannot be deployed immediately?
Avoid switching the affected controller to host mode after a gadget-start failure. Returning the controller to the required idle state before changing roles is necessary under the DRD controller design, but the provided data does not specify a manual recovery procedure.
How can I identify that a system has encountered this condition?
Kernel logs may show gadget startup errors such as "failed to start g1: -19," "Failed to add gadget," and "set role 2 has failed." A subsequent host-mode transition may produce an xHCI "synchronous external abort" with xhci_gen_setup in the backtrace.