CVE-2026-90020: USB: gadget: fix NULL pointer dereference in gadget_dev_ioctl()
In the Linux kernel, the following vulnerability has been resolved:
USB: gadget: fix NULL pointer dereference in gadgetdevioctl()
gadgetdevioctl() reads dev->gadget before acquiring dev->lock, but dev->state is checked after acquiring the lock. Therefore a concurrent bind can change the device state between these operations, which can leave ioctl with a stale NULL gadget pointer and causing a NULL pointer dereference at gadget->ops->ioctl.
Read dev->gadget while holding dev->lock so that the gadget pointer and device state are sampled consistently.
Affected Software
Event History
Frequently Asked Questions
What timing is required to trigger this issue?
An ioctl operation must race with a concurrent gadget bind. The bind can change the device state after ioctl reads the gadget pointer but before ioctl checks the state under the device lock, leaving ioctl with a stale NULL pointer.
Which Linux systems are relevant?
The issue is relevant to Linux kernel systems using the USB gadget interface, specifically where gadget_dev_ioctl() can run concurrently with gadget binding. The provided data does not identify affected kernel version ranges or configuration defaults.