CVE-2026-31755: usb: cdns3: gadget: fix NULL pointer dereference in ep_queue
In the Linux kernel, the following vulnerability has been resolved:
usb: cdns3: gadget: fix NULL pointer dereference in epqueue
When the gadget endpoint is disabled or not yet configured, the ep->desc pointer can be NULL. This leads to a NULL pointer dereference when cdns3gadgetepqueue() is called, causing a kernel crash.
Add a check to return -ESHUTDOWN if ep->desc is NULL, which is the standard return code for unconfigured endpoints.
This prevents potential crashes when epqueue is called on endpoints that are not ready.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1 - Compensating control
In the Linux kernel usb: cdns3 gadget __cdns3_gadget_ep_queue() path, check whether ep->desc is NULL and return -ESHUTDOWN for unconfigured or disabled endpoints.
Event History
Frequently Asked Questions
What conditions are required to trigger the crash?
A local attacker or local process needs the ability to invoke gadget endpoint queueing on a Cadence USB3 gadget endpoint while that endpoint is disabled or has not yet been configured. In that state, the endpoint descriptor can be NULL and the queue operation can crash the kernel.
What is the impact of successful exploitation?
Successful triggering causes a kernel crash, resulting in a denial of service. The provided severity vector indicates no confidentiality or integrity impact.
How can systems mitigate the issue before applying the fix?
Avoid calling ep_queue on gadget endpoints that are disabled or not configured. Callers should ensure the endpoint is ready before queueing requests and handle an unconfigured endpoint as a shutdown condition.
How does the fix change affected behavior?
The fix checks whether ep->desc is NULL before queueing. Instead of dereferencing the NULL pointer, it returns -ESHUTDOWN, the standard error for an unconfigured endpoint.