CVE-2026-90019: usb: gadget: fix null pointer dereference in usb_put_function_instance()
In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: fix null pointer dereference in usbputfunctioninstance()
usbputfunctioninstance() attempts to dereference fd inside fi struct to get mod in uvcallocinst() error path. However, fd is not allocated until later in trygetusbfunctioninstance() after allocating fi in uvcallocinst() and thus guranteed to be null in error path. Fix this by adding a null check for fi->fd that returns if fd is null.
Affected Software
Event History
Frequently Asked Questions
What conditions are required to trigger the null pointer dereference?
The issue occurs in the UVC function-instance allocation error path, when usb_put_function_instance() is called before fi->fd has been allocated. In that path, fi->fd is guaranteed to be null.
What is the immediate mitigation if a patched kernel cannot be deployed?
Avoid the affected UVC function-instance allocation error path where possible. The provided information does not identify a configuration change or runtime workaround that prevents the condition more specifically.
How can I determine whether my kernel includes the fix?
Check whether your kernel contains one of the referenced stable commits: 0fc54a00954f9f4c3e3d4ffa64a530685d99a39b, 6e6736c049683380f5e20becde498986e9293ca4, or 3a9691fff79bcce95338435599df6d3ae433cfdc. The fix adds a null check for fi->fd in usb_put_function_instance() and returns when it is null.