CVE-2026-31756: usb: dwc2: gadget: Fix spin_lock/unlock mismatch in dwc2_hsotg_udc_stop()
In the Linux kernel, the following vulnerability has been resolved:
usb: dwc2: gadget: Fix spinlock/unlock mismatch in dwc2hsotgudcstop()
dwc2gadgetexitclockgating() internally calls callgadget() macro, which expects hsotg->lock to be held since it does spinunlock/spinlock around the gadget driver callback invocation.
However, dwc2hsotgudcstop() calls dwc2gadgetexitclockgating() without holding the lock. This leads to: - spinunlock on a lock that is not held (undefined behavior) - The lock remaining held after dwc2gadgetexitclockgating() returns, causing a deadlock when spinlockirqsave() is called later in the same function.
Fix this by acquiring hsotg->lock before calling dwc2gadgetexitclockgating() and releasing it afterwards, which satisfies the locking requirement of the callgadget() macro.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1 - Compensating control
In dwc2_hsotg_udc_stop(), acquire hsotg->lock before calling dwc2_gadget_exit_clock_gating() and release it afterward, satisfying the locking requirement of the call_gadget() macro.
Event History
Frequently Asked Questions
Which systems are in scope for this issue?
Systems running the Linux kernel's dwc2 gadget component are in scope. The listed software includes Linux Linux kernel and debian/linux.
What level of access is needed to exploit this vulnerability?
The severity vector indicates local access and low privileges are required. No user interaction is required.