CVE-2026-31755 - Vulnerability Details

- usb: cdns3: gadget: fix NULL pointer dereference in ep_queue

Description

In the Linux kernel, the following vulnerability has been resolved:

usb: cdns3: gadget: fix NULL pointer dereference in ep_queue

When the gadget endpoint is disabled or not yet configured, the ep->desc
pointer can be NULL. This leads to a NULL pointer dereference when
__cdns3_gadget_ep_queue() is called, causing a kernel crash.

Add a check to return -ESHUTDOWN if ep->desc is NULL, which is the
standard return code for unconfigured endpoints.

This prevents potential crashes when ep_queue is called on endpoints
that are not ready.

Published: 2026-05-01

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A NULL pointer dereference in the Linux USB cdns3 gadget driver causes a kernel crash when an endpoint is disabled or not yet configured. The bug is triggered by a call to __cdns3_gadget_ep_queue() when the ep->desc pointer is NULL, leading to an unhandled dereference and system shutdown. The impact is a denial of service; the system becomes unavailable until reboot.

Affected Systems

All Linux kernel installations that include the cdns3 USB gadget driver and have not yet incorporated the patch are vulnerable. No specific versions are listed, so any kernel embedding this driver before the fix is at risk.

Risk and Exploitability

The CVSS score is 5.5 and the EPSS score is not available, making the exploitation likelihood unclear. The bug can be triggered by an attacker with control over the USB gadget interface, which may be achievable locally or via compromised device configuration. Because the vulnerability leads to a kernel crash, it is not a remote code execution but a severe local denial of service. The vulnerability is not listed as a known exploited vulnerability in the KEV catalog.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`7733f6c32e36ff9d7adadf40001039bf219b1cbe`	affected	< 3d1433fe34b224b90259e207e5389e95b504ef04
`7733f6c32e36ff9d7adadf40001039bf219b1cbe`	affected	< fb2ad0c1334a3eccfe4ed203f9eef5a4879226f6
`7733f6c32e36ff9d7adadf40001039bf219b1cbe`	affected	< 9ab9b0e5fcdac325f950fc8b6caa08a9e22a0db9
`7733f6c32e36ff9d7adadf40001039bf219b1cbe`	affected	< d61446dfc9d387775bb1b95b081953201b9222af
`7733f6c32e36ff9d7adadf40001039bf219b1cbe`	affected	< 390536cc6af4ca5566bc3bf1f8b704700380cd2c
`7733f6c32e36ff9d7adadf40001039bf219b1cbe`	affected	< 14bf08ab2cdfcdfd3f13e799d06692a1b3e0745f
`7733f6c32e36ff9d7adadf40001039bf219b1cbe`	affected	< 7f6f127b9bc34bed35f56faf7ecb1561d6b39000

Linux

affected

Version	Status	Constraints
`5.4`	affected	—
`0`	unaffected	< 5.4
`5.15.203`	unaffected	≤ 5.15.*
`6.1.168`	unaffected	≤ 6.1.*
`6.6.134`	unaffected	≤ 6.6.*
`6.12.81`	unaffected	≤ 6.12.*
`6.18.22`	unaffected	≤ 6.18.*
`6.19.12`	unaffected	≤ 6.19.*
`7.0`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[7733f6c32e36ff9d7adadf40001039bf219b1cbe,3d1433fe34b224b90259e207e5389e95b504ef04)`	affected	code_commit	—
`[7733f6c32e36ff9d7adadf40001039bf219b1cbe,fb2ad0c1334a3eccfe4ed203f9eef5a4879226f6)`	affected	code_commit	—
`[7733f6c32e36ff9d7adadf40001039bf219b1cbe,9ab9b0e5fcdac325f950fc8b6caa08a9e22a0db9)`	affected	code_commit	—
`[7733f6c32e36ff9d7adadf40001039bf219b1cbe,d61446dfc9d387775bb1b95b081953201b9222af)`	affected	code_commit	—
`[7733f6c32e36ff9d7adadf40001039bf219b1cbe,390536cc6af4ca5566bc3bf1f8b704700380cd2c)`	affected	code_commit	—
`[7733f6c32e36ff9d7adadf40001039bf219b1cbe,14bf08ab2cdfcdfd3f13e799d06692a1b3e0745f)`	affected	code_commit	—
`[7733f6c32e36ff9d7adadf40001039bf219b1cbe,7f6f127b9bc34bed35f56faf7ecb1561d6b39000)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`5.4`	affected	generic	—
`[0,5.4)`	unaffected	semver	—
`[5.15.203,5.16.0)`	unaffected	semver	—
`[6.1.168,6.2.0)`	unaffected	semver	—
`[6.6.134,6.7.0)`	unaffected	semver	—
`[6.12.81,6.13.0)`	unaffected	semver	—
`[6.18.22,6.19.0)`	unaffected	semver	—
`[6.19.12,6.20.0)`	unaffected	semver	—
`[0,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Update the Linux kernel to a version that incorporates the patch (commit 14bf08ab2cdf…)
Reboot the system after updating to ensure the new code is loaded
Avoid calling ep_queue on endpoints that are not initialized; verify that all gadget endpoints are fully configured before use
If an immediate kernel update is not possible, disable or unload the cdns3 gadget module to prevent the fault

Generated by OpenCVE AI on May 2, 2026 at 10:26 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4561-1	linux-6.1 security update
Debian DSA	DSA-6243-1	linux security update

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00024.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/14bf08ab2cdfcdfd3f13e799d06692a1b3e0745f
https://git.kernel.org/stable/c/390536cc6af4ca5566bc3bf1f8b704700380cd2c
https://git.kernel.org/stable/c/3d1433fe34b224b90259e207e5389e95b504ef04
https://git.kernel.org/stable/c/7f6f127b9bc34bed35f56faf7ecb1561d6b39000
https://git.kernel.org/stable/c/9ab9b0e5fcdac325f950fc8b6caa08a9e22a0db9
https://git.kernel.org/stable/c/d61446dfc9d387775bb1b95b081953201b9222af
https://git.kernel.org/stable/c/fb2ad0c1334a3eccfe4ed203f9eef5a4879226f6
https://lore.kernel.org/linux-cve-announce/2026050143-CVE-2026-31755-c004@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-31755
https://www.cve.org/CVERecord?id=CVE-2026-31755

History

Sat, 02 May 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-476
References		https://lore.kernel.org/linux-cve-announce/2026050143-CVE-2026-31755-c004@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-31755 https://www.cve.org/CVERecord?id=CVE-2026-31755
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Fri, 01 May 2026 14:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: usb: cdns3: gadget: fix NULL pointer dereference in ep_queue When the gadget endpoint is disabled or not yet configured, the ep->desc pointer can be NULL. This leads to a NULL pointer dereference when __cdns3_gadget_ep_queue() is called, causing a kernel crash. Add a check to return -ESHUTDOWN if ep->desc is NULL, which is the standard return code for unconfigured endpoints. This prevents potential crashes when ep_queue is called on endpoints that are not ready.
Title		usb: cdns3: gadget: fix NULL pointer dereference in ep_queue
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/14bf08ab2cdfcdfd3f13e799d06692a1b3e0745f https://git.kernel.org/stable/c/390536cc6af4ca5566bc3bf1f8b704700380cd2c https://git.kernel.org/stable/c/3d1433fe34b224b90259e207e5389e95b504ef04 https://git.kernel.org/stable/c/7f6f127b9bc34bed35f56faf7ecb1561d6b39000 https://git.kernel.org/stable/c/9ab9b0e5fcdac325f950fc8b6caa08a9e22a0db9 https://git.kernel.org/stable/c/d61446dfc9d387775bb1b95b081953201b9222af https://git.kernel.org/stable/c/fb2ad0c1334a3eccfe4ed203f9eef5a4879226f6

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-05-01T14:14:46.288Z

Updated: 2026-05-01T14:14:46.288Z

Reserved: 2026-03-09T15:48:24.139Z

Link: CVE-2026-31755

Vulnrichment

No data.

NVD

Status : Awaiting Analysis

Published: 2026-05-01T15:16:38.460

Modified: 2026-05-01T15:24:14.893

Link: CVE-2026-31755

Redhat

Severity : Moderate

Publid Date: 2026-05-01T00:00:00Z

Links: CVE-2026-31755 - Bugzilla

OpenCVE Enrichment

Updated: 2026-05-02T10:30:40Z

Weaknesses

CWE-476

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object