CVE-2026-98756: usb: cdns3: Fix NULL pointer dereference in cdns3_pci_probe
In the Linux kernel, the following vulnerability has been resolved:
usb: cdns3: Fix NULL pointer dereference in cdns3pciprobe
The Cadence USBSS controller is a two-function PCI device. The first probed function allocates the driver data and stores it with pcisetdrvdata(), while the second function reuses it via pcigetdrvdata() when pciisenabled() reports that the first function has already been probed.
When the second function is probed while the first one has been enabled but has not yet set its driver data, pcigetdrvdata() returns NULL, and the subsequent wrap->devfn assignment dereferences a NULL pointer and crashes the kernel. logs: Call trace: cdns3pciprobe+0xa4/0x300 localpciprobe+0x44/0xa8 pcicallprobe+0x54/0x158 pcideviceprobe+0x84/0x100 reallyprobe+0x184/0x3d0 driverprobedevice+0x80/0x178 driverprobedevice+0x44/0xe8 driverattach+0xec/0x1f8 busforeachdev+0x7c/0xe0 driverattach+0x28/0x38 busadddriver+0x110/0x238 driverregister+0x64/0x128 pciregisterdriver+0x50/0x60 cdns3pcidriverinit+0x28/0x38 dooneinitcall+0x5c/0x280 doinitcalls+0x104/0x1d8 kernelinitfreeable+0x140/0x218 kernelinit+0x28/0x1f8 retfromfork+0x10/0x20
Return -EPROBEDEFER in this case so that probing is retried after the first function has completed its probe.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.113-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.2.10-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 5.10.273 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 5.15.224 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.191 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.160 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.113 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.56 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.2.10 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Compensating control
Update cdns3_pci_probe to return -EPROBE_DEFER when the second PCI function finds pci_get_drvdata() NULL while the first function has been enabled but has not completed setting its driver data, so probing is retried after the first function completes.
Event History
Frequently Asked Questions
What systems are exposed to this issue?
Systems using the Linux kernel with a Cadence USBSS controller presented as a two-function PCI device are exposed during probing of the cdns3 PCI driver. The issue depends on the interaction between the controller's two PCI functions.
What triggers the kernel crash?
The crash occurs when the second PCI function is probed after the first function has been enabled but before the first function has stored its driver data. In that timing window, pci_get_drvdata() returns NULL and the driver dereferences it while assigning wrap->devfn.
How can I recognize this issue in logs?
Affected systems can show a NULL pointer dereference crash with cdns3_pci_probe in the call trace. The provided trace includes cdns3_pci_probe, local_pci_probe, pci_device_probe, and cdns3_pci_driver_init.