CVE-2026-31754 - Vulnerability Details

- usb: cdns3: gadget: fix state inconsistency on gadget init failure

Description

In the Linux kernel, the following vulnerability has been resolved:

usb: cdns3: gadget: fix state inconsistency on gadget init failure

When cdns3_gadget_start() fails, the DRD hardware is left in gadget mode
while software state remains INACTIVE, creating hardware/software state
inconsistency.

When switching to host mode via sysfs:
echo host > /sys/class/usb_role/13180000.usb-role-switch/role

The role state is not set to CDNS_ROLE_STATE_ACTIVE due to the error,
so cdns_role_stop() skips cleanup because state is still INACTIVE.
This violates the DRD controller design specification (Figure22),
which requires returning to idle state before switching roles.

This leads to a synchronous external abort in xhci_gen_setup() when
setting up the host controller:

[ 516.440698] configfs-gadget 13180000.usb: failed to start g1: -19
[ 516.442035] cdns-usb3 13180000.usb: Failed to add gadget
[ 516.443278] cdns-usb3 13180000.usb: set role 2 has failed
...
[ 1301.375722] xhci-hcd xhci-hcd.1.auto: xHCI Host Controller
[ 1301.377716] Internal error: synchronous external abort: 96000010 [#1] PREEMPT SMP
[ 1301.382485] pc : xhci_gen_setup+0xa4/0x408
[ 1301.393391] backtrace:
...
xhci_gen_setup+0xa4/0x408 <-- CRASH
xhci_plat_setup+0x44/0x58
usb_add_hcd+0x284/0x678
...
cdns_role_set+0x9c/0xbc <-- Role switch

Fix by calling cdns_drd_gadget_off() in the error path to properly
clean up the DRD gadget state.

Published: 2026-05-01

Score: 7.0 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The bug occurs in the Linux kernel's cdns3 USB driver. When the gadget start routine fails, the DRD hardware remains in gadget mode while the software state stays INACTIVE. Switching to host mode through sysfs then leads the role switch function to skip required cleanup, leaving the controller in an invalid state. The resulting synchronous external abort in xhci_gen_setup() causes a kernel crash. This crash essentially terminates the system or requires a reboot, representing a denial‑of‑service condition for environments that rely on USB role switching or DRD hardware.

Affected Systems

All Linux kernel configurations that include the cdns3 USB controller driver are affected. The kernel repository does not specify version ranges for this vulnerability, so any kernel containing the unpatched cdns3 driver is potentially impacted.

Risk and Exploitability

The CVSS score of 7.0 indicates high severity, and the EPSS score is not available, implying limited public exploitation data. The vulnerability can be triggered by a failure in the gadget start routine, an event that may be difficult to control externally. Nonetheless, the flaw leads directly to a system crash whenever a role switch is attempted after the failure, representing a local denial‑of‑service condition. The lack of a CISA KEV listing does not diminish this risk for devices using this controller.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`7733f6c32e36ff9d7adadf40001039bf219b1cbe`	affected	< fb7110a052467098967284ef14d306810b354937
`7733f6c32e36ff9d7adadf40001039bf219b1cbe`	affected	< 9b1d301fbae837bf6979a19030b81d869bb15f7a
`7733f6c32e36ff9d7adadf40001039bf219b1cbe`	affected	< cfca84f5986afceb63a3adf39d4a98e915aebbc2
`7733f6c32e36ff9d7adadf40001039bf219b1cbe`	affected	< c7e475ae3a5593c5db21b3b7dca4ba8bdac9b47f
`7733f6c32e36ff9d7adadf40001039bf219b1cbe`	affected	< 5a85599ca4d2584d89dc69f4fc49303b75a42338
`7733f6c32e36ff9d7adadf40001039bf219b1cbe`	affected	< b490f0e477d26d29ed51e5dc47e3b9bd31bcb49f
`7733f6c32e36ff9d7adadf40001039bf219b1cbe`	affected	< c32f8748d70c8fc77676ad92ed76cede17bf2c48

Linux

affected

Version	Status	Constraints
`5.4`	affected	—
`0`	unaffected	< 5.4
`5.15.203`	unaffected	≤ 5.15.*
`6.1.168`	unaffected	≤ 6.1.*
`6.6.134`	unaffected	≤ 6.6.*
`6.12.81`	unaffected	≤ 6.12.*
`6.18.22`	unaffected	≤ 6.18.*
`6.19.12`	unaffected	≤ 6.19.*
`7.0`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[7733f6c32e36ff9d7adadf40001039bf219b1cbe,fb7110a052467098967284ef14d306810b354937)`	affected	code_commit	—
`[7733f6c32e36ff9d7adadf40001039bf219b1cbe,9b1d301fbae837bf6979a19030b81d869bb15f7a)`	affected	code_commit	—
`[7733f6c32e36ff9d7adadf40001039bf219b1cbe,b490f0e477d26d29ed51e5dc47e3b9bd31bcb49f)`	affected	code_commit	—
`[7733f6c32e36ff9d7adadf40001039bf219b1cbe,c32f8748d70c8fc77676ad92ed76cede17bf2c48)`	affected	code_commit	—
`[7733f6c32e36ff9d7adadf40001039bf219b1cbe,c7e475ae3a5593c5db21b3b7dca4ba8bdac9b47f)`	affected	code_commit	—
`[7733f6c32e36ff9d7adadf40001039bf219b1cbe,cfca84f5986afceb63a3adf39d4a98e915aebbc2)`	affected	code_commit	—
`[7733f6c32e36ff9d7adadf40001039bf219b1cbe,fb7110a052467098967284ef14d306810b354937)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`5.4`	affected	generic	—
`[0,5.4)`	unaffected	semver	—
`[5.15.203,5.16.0)`	unaffected	semver	—
`[6.1.168,6.2.0)`	unaffected	semver	—
`[6.6.134,6.7.0)`	unaffected	semver	—
`[6.12.81,6.13.0)`	unaffected	semver	—
`[6.18.22,6.19.0)`	unaffected	semver	—
`[7.0,*]`	unaffected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

If a kernel upgrade is not immediately possible, disable or remove the cdns3 USB driver or the DRD gadget functionality from the system configuration.
Ensure that any role switch operations are avoided in systems where USB role switching is not required.
When a kernel update becomes available, install the latest version that includes the cdns3 driver fix.

Generated by OpenCVE AI on May 2, 2026 at 10:26 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4561-1	linux-6.1 security update
Debian DSA	DSA-6243-1	linux security update

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.0003.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/5a85599ca4d2584d89dc69f4fc49303b75a42338
https://git.kernel.org/stable/c/9b1d301fbae837bf6979a19030b81d869bb15f7a
https://git.kernel.org/stable/c/b490f0e477d26d29ed51e5dc47e3b9bd31bcb49f
https://git.kernel.org/stable/c/c32f8748d70c8fc77676ad92ed76cede17bf2c48
https://git.kernel.org/stable/c/c7e475ae3a5593c5db21b3b7dca4ba8bdac9b47f
https://git.kernel.org/stable/c/cfca84f5986afceb63a3adf39d4a98e915aebbc2
https://git.kernel.org/stable/c/fb7110a052467098967284ef14d306810b354937
https://lore.kernel.org/linux-cve-announce/2026050143-CVE-2026-31754-ab16@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-31754
https://www.cve.org/CVERecord?id=CVE-2026-31754

History

Sat, 02 May 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-372
References		https://lore.kernel.org/linux-cve-announce/2026050143-CVE-2026-31754-ab16@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-31754 https://www.cve.org/CVERecord?id=CVE-2026-31754
Metrics	threat_severity `None`	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}` threat_severity `Moderate`

Fri, 01 May 2026 14:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: usb: cdns3: gadget: fix state inconsistency on gadget init failure When cdns3_gadget_start() fails, the DRD hardware is left in gadget mode while software state remains INACTIVE, creating hardware/software state inconsistency. When switching to host mode via sysfs: echo host > /sys/class/usb_role/13180000.usb-role-switch/role The role state is not set to CDNS_ROLE_STATE_ACTIVE due to the error, so cdns_role_stop() skips cleanup because state is still INACTIVE. This violates the DRD controller design specification (Figure22), which requires returning to idle state before switching roles. This leads to a synchronous external abort in xhci_gen_setup() when setting up the host controller: [ 516.440698] configfs-gadget 13180000.usb: failed to start g1: -19 [ 516.442035] cdns-usb3 13180000.usb: Failed to add gadget [ 516.443278] cdns-usb3 13180000.usb: set role 2 has failed ... [ 1301.375722] xhci-hcd xhci-hcd.1.auto: xHCI Host Controller [ 1301.377716] Internal error: synchronous external abort: 96000010 [#1] PREEMPT SMP [ 1301.382485] pc : xhci_gen_setup+0xa4/0x408 [ 1301.393391] backtrace: ... xhci_gen_setup+0xa4/0x408 <-- CRASH xhci_plat_setup+0x44/0x58 usb_add_hcd+0x284/0x678 ... cdns_role_set+0x9c/0xbc <-- Role switch Fix by calling cdns_drd_gadget_off() in the error path to properly clean up the DRD gadget state.
Title		usb: cdns3: gadget: fix state inconsistency on gadget init failure
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/5a85599ca4d2584d89dc69f4fc49303b75a42338 https://git.kernel.org/stable/c/9b1d301fbae837bf6979a19030b81d869bb15f7a https://git.kernel.org/stable/c/b490f0e477d26d29ed51e5dc47e3b9bd31bcb49f https://git.kernel.org/stable/c/c32f8748d70c8fc77676ad92ed76cede17bf2c48 https://git.kernel.org/stable/c/c7e475ae3a5593c5db21b3b7dca4ba8bdac9b47f https://git.kernel.org/stable/c/cfca84f5986afceb63a3adf39d4a98e915aebbc2 https://git.kernel.org/stable/c/fb7110a052467098967284ef14d306810b354937

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-05-01T14:14:45.628Z

Updated: 2026-05-01T14:14:45.628Z

Reserved: 2026-03-09T15:48:24.139Z

Link: CVE-2026-31754

Vulnrichment

No data.

NVD

Status : Awaiting Analysis

Published: 2026-05-01T15:16:38.330

Modified: 2026-05-01T15:24:14.893

Link: CVE-2026-31754

Redhat

Severity : Moderate

Publid Date: 2026-05-01T00:00:00Z

Links: CVE-2026-31754 - Bugzilla

OpenCVE Enrichment

Updated: 2026-05-02T10:30:40Z

Weaknesses

CWE-372

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object