CVE-2026-90020: USB: gadget: fix NULL pointer dereference in gadget_dev_ioctl()
In the Linux kernel, the following vulnerability has been resolved:
USB: gadget: fix NULL pointer dereference in gadgetdevioctl()
gadgetdevioctl() reads dev->gadget before acquiring dev->lock, but dev->state is checked after acquiring the lock. Therefore a concurrent bind can change the device state between these operations, which can leave ioctl with a stale NULL gadget pointer and causing a NULL pointer dereference at gadget->ops->ioctl.
Read dev->gadget while holding dev->lock so that the gadget pointer and device state are sampled consistently.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.157.1-1
Event History
Frequently Asked Questions
What timing is required to trigger this issue?
An ioctl operation must race with a concurrent gadget bind. The bind can change the device state after ioctl reads the gadget pointer but before ioctl checks the state under the device lock, leaving ioctl with a stale NULL pointer.
Which Linux systems are relevant?
The issue is relevant to Linux kernel systems using the USB gadget interface, specifically where gadget_dev_ioctl() can run concurrently with gadget binding. The provided data does not identify affected kernel version ranges or configuration defaults.