CVE-2026-45911: usb: cdns3: fix role switching during resume
In the Linux kernel, the following vulnerability has been resolved:
usb: cdns3: fix role switching during resume
If the role change while we are suspended, the cdns3 driver switches to the new mode during resume. However, switching to host mode in this context causes a NULL pointer dereference.
The host role's start() operation registers a xhci-hcd device, but its probe is deferred while we are in the resume path. The host role's resume() operation assumes the xhci-hcd device is already probed, which is not the case, leading to the dereference. Since the start() operation of the new role is already called, the resume operation can be skipped.
So skip the resume operation for the new role if a role switch occurs during resume. Once the resume sequence is complete, the xhci-hcd device can be probed in case of host mode.
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000208 Mem abort info: ... Data abort info: ... [0000000000000208] pgd=0000000000000000, p4d=0000000000000000 Internal error: Oops: 0000000096000004 [#1] SMP Modules linked in: CPU: 0 UID: 0 PID: 146 Comm: sh Not tainted 6.19.0-rc7-00013-g6e64f4aabfae-dirty #135 PREEMPT Hardware name: Texas Instruments J7200 EVM (DT) pstate: 20000005 (nzCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : usbhcdisprimaryhcd+0x0/0x1c lr : cdnshostresume+0x24/0x5c ... Call trace: usbhcdisprimaryhcd+0x0/0x1c (P) cdnsresume+0x6c/0xbc cdns3controllerresume.isra.0+0xe8/0x17c cdns3platresume+0x18/0x24 platformpmresume+0x2c/0x68 dpmruncallback+0x90/0x248 deviceresume+0x100/0x24c dpmresume+0x190/0x2ec dpmresumeend+0x18/0x34 suspenddevicesandenter+0x2b0/0xa44 pmsuspend+0x16c/0x5fc statestore+0x80/0xec kobjattrstore+0x18/0x2c sysfskfwrite+0x7c/0x94 kernfsfopwriteiter+0x130/0x1dc vfswrite+0x240/0x370 ksyswrite+0x70/0x108 arm64syswrite+0x1c/0x28 invokesyscall+0x48/0x10c el0svccommon.constprop.0+0x40/0xe0 doel0svc+0x1c/0x28 el0svc+0x34/0x108 el0t64synchandler+0xa0/0xe4 el0t64sync+0x198/0x19c Code: 52800003 f9407ca5 d63f00a0 17ffffe4 (f9410401) ---[ end trace 0000000000000000 ]---
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Skip the resume operation for the new role if a USB role switch occurs while the system is in the resume path (i.e., do not run the resume sequence for the role that became active after the switch). Implement this change in the cdns3 driver's resume path (e.g., cdns3_controller_resume / cdns3_plat_resume) to avoid attempting to resume an xhci-hcd device that has not been probed, preventing the NULL pointer dereference described in the report.
usb: cdns3 driver
Event History
Frequently Asked Questions
What is the severity of CVE-2026-45911?
CVE-2026-45911 has a risk score of 38, indicating a moderate level of severity.
How do I fix CVE-2026-45911?
To resolve CVE-2026-45911, update your Linux kernel to the version that includes the patch for this vulnerability.
What does CVE-2026-45911 affect?
CVE-2026-45911 affects the cdns3 driver in the Linux kernel, particularly during role switching while the device is suspended.
What is a NULL pointer dereference in the context of CVE-2026-45911?
A NULL pointer dereference in CVE-2026-45911 occurs when the cdns3 driver attempts to switch to host mode while suspended, leading to a system error.
When was CVE-2026-45911 published?
CVE-2026-45911 was published on May 27, 2026.