CVE-2026-31755

usb: cdns3: gadget: fix NULL pointer dereference in ep_queue

Published May 1, 2026 CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

usb: cdns3: gadget: fix NULL pointer dereference in ep_queue

When the gadget endpoint is disabled or not yet configured, the ep->desc
pointer can be NULL. This leads to a NULL pointer dereference when
__cdns3_gadget_ep_queue() is called, causing a kernel crash.

Add a check to return -ESHUTDOWN if ep->desc is NULL, which is the
standard return code for unconfigured endpoints.

This prevents potential crashes when ep_queue is called on endpoints
that are not ready.

Analysis

Technical impact

A NULL pointer dereference in the Linux USB cdns3 gadget driver causes a kernel crash when an endpoint is disabled or not yet configured. The bug is triggered by a call to __cdns3_gadget_ep_queue() when the ep->desc pointer is NULL, leading to an unhandled dereference and system shutdown. The impact is a denial of service; the system becomes unavailable until reboot.

Affected Systems

All Linux kernel installations that include the cdns3 USB gadget driver and have not yet incorporated the patch are vulnerable. No specific versions are listed, so any kernel embedding this driver before the fix is at risk.

Risk and Exploitability

The CVSS score is 5.5 and the EPSS score is not available, making the exploitation likelihood unclear. The bug can be triggered by an attacker with control over the USB gadget interface, which may be achievable locally or via compromised device configuration. Because the vulnerability leads to a kernel crash, it is not a remote code execution but a severe local denial of service. The vulnerability is not listed as a known exploited vulnerability in the KEV catalog.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`7733f6c32e36ff9d7adadf40001039bf219b1cbe`	affected	< 3cf0580a09d417eab41ce914a11f9cde3a121871
`7733f6c32e36ff9d7adadf40001039bf219b1cbe`	affected	< 3d1433fe34b224b90259e207e5389e95b504ef04
`7733f6c32e36ff9d7adadf40001039bf219b1cbe`	affected	< fb2ad0c1334a3eccfe4ed203f9eef5a4879226f6
`7733f6c32e36ff9d7adadf40001039bf219b1cbe`	affected	< 9ab9b0e5fcdac325f950fc8b6caa08a9e22a0db9
`7733f6c32e36ff9d7adadf40001039bf219b1cbe`	affected	< d61446dfc9d387775bb1b95b081953201b9222af
`7733f6c32e36ff9d7adadf40001039bf219b1cbe`	affected	< 390536cc6af4ca5566bc3bf1f8b704700380cd2c
`7733f6c32e36ff9d7adadf40001039bf219b1cbe`	affected	< 14bf08ab2cdfcdfd3f13e799d06692a1b3e0745f
`7733f6c32e36ff9d7adadf40001039bf219b1cbe`	affected	< 7f6f127b9bc34bed35f56faf7ecb1561d6b39000

Linux

affected

Version	Status	Constraints
`5.4`	affected	—
`0`	unaffected	< 5.4
`5.10.260`	unaffected	≤ 5.10.*
`5.15.203`	unaffected	≤ 5.15.*
`6.1.168`	unaffected	≤ 6.1.*
`6.6.134`	unaffected	≤ 6.6.*
`6.12.81`	unaffected	≤ 6.12.*
`6.18.22`	unaffected	≤ 6.18.*
`6.19.12`	unaffected	≤ 6.19.*
`7.0`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc1::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc2::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc3::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc4::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc5::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc6::::::

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[7733f6c32e36ff9d7adadf40001039bf219b1cbe,3d1433fe34b224b90259e207e5389e95b504ef04)`	affected	code_commit	—
`[7733f6c32e36ff9d7adadf40001039bf219b1cbe,fb2ad0c1334a3eccfe4ed203f9eef5a4879226f6)`	affected	code_commit	—
`[7733f6c32e36ff9d7adadf40001039bf219b1cbe,9ab9b0e5fcdac325f950fc8b6caa08a9e22a0db9)`	affected	code_commit	—
`[7733f6c32e36ff9d7adadf40001039bf219b1cbe,d61446dfc9d387775bb1b95b081953201b9222af)`	affected	code_commit	—
`[7733f6c32e36ff9d7adadf40001039bf219b1cbe,390536cc6af4ca5566bc3bf1f8b704700380cd2c)`	affected	code_commit	—
`[7733f6c32e36ff9d7adadf40001039bf219b1cbe,14bf08ab2cdfcdfd3f13e799d06692a1b3e0745f)`	affected	code_commit	—
`[7733f6c32e36ff9d7adadf40001039bf219b1cbe,7f6f127b9bc34bed35f56faf7ecb1561d6b39000)`	affected	code_commit	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`5.4`	affected	generic	—
`[0,5.4)`	unaffected	semver	—
`[5.15.203,5.16.0)`	unaffected	semver	—
`[6.1.168,6.2.0)`	unaffected	semver	—
`[6.6.134,6.7.0)`	unaffected	semver	—
`[6.12.81,6.13.0)`	unaffected	semver	—
`[6.18.22,6.19.0)`	unaffected	semver	—
`[6.19.12,6.20.0)`	unaffected	semver	—
`[0,*]`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update the Linux kernel to a version that incorporates the patch (commit 14bf08ab2cdf…)
Reboot the system after updating to ensure the new code is loaded
Avoid calling ep_queue on endpoints that are not initialized; verify that all gadget endpoints are fully configured before use
If an immediate kernel update is not possible, disable or unload the cdns3 gadget module to prevent the fault

Generated by OpenCVE AI on May 2, 2026 at 10:26 UTC.

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4561-1	linux-6.1 security update
Debian DLA	DLA-4717-1	linux security update
Debian DSA	DSA-6243-1	linux security update
Ubuntu USN	USN-8567-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8574-1	Linux kernel (GCP FIPS) vulnerabilities
Ubuntu USN	USN-8575-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8576-1	Linux kernel (NVIDIA Tegra) vulnerabilities
Ubuntu USN	USN-8574-2	Linux kernel vulnerabilities
Ubuntu USN	USN-8595-1	Linux kernel (Oracle) vulnerabilities
Ubuntu USN	USN-8596-1	Linux kernel (NVIDIA) vulnerabilities
Ubuntu USN	USN-8575-2	Linux kernel vulnerabilities
Ubuntu USN	USN-8576-2	Linux kernel (NVIDIA Tegra) vulnerabilities
Ubuntu USN	USN-8597-1	Linux kernel (IBM) vulnerabilities
Ubuntu USN	USN-8575-3	Linux kernel vulnerabilities
Ubuntu USN	USN-8595-2	Linux kernel (AWS) vulnerabilities
Ubuntu USN	USN-8606-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8607-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-8608-1	Linux kernel (Azure FIPS) vulnerabilities
Ubuntu USN	USN-8609-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-8610-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-8574-3	Linux kernel vulnerabilities
Ubuntu USN	USN-8595-3	Linux kernel (AWS) vulnerabilities
Ubuntu USN	USN-8619-1	Linux kernel (HWE) vulnerabilities
Ubuntu USN	USN-8620-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8620-2	Linux kernel (Azure FIPS) vulnerabilities
Ubuntu USN	USN-8620-3	Linux kernel (Intel IoTG) vulnerabilities
Ubuntu USN	USN-8620-4	Linux kernel (Intel IoTG) vulnerabilities
Ubuntu USN	USN-8665-1	Linux kernel (Raspberry Pi) vulnerabilities
Ubuntu USN	USN-8668-1	Linux kernel (GCP) vulnerabilities
Ubuntu USN	USN-8668-2	Linux kernel (Raspberry Pi) vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.123% probability within 30 days)

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/14bf08ab2cdfcdfd3f13e799d06692a1b3e0745f
https://git.kernel.org/stable/c/390536cc6af4ca5566bc3bf1f8b704700380cd2c
https://git.kernel.org/stable/c/3cf0580a09d417eab41ce914a11f9cde3a121871
https://git.kernel.org/stable/c/3d1433fe34b224b90259e207e5389e95b504ef04
https://git.kernel.org/stable/c/7f6f127b9bc34bed35f56faf7ecb1561d6b39000
https://git.kernel.org/stable/c/9ab9b0e5fcdac325f950fc8b6caa08a9e22a0db9
https://git.kernel.org/stable/c/d61446dfc9d387775bb1b95b081953201b9222af
https://git.kernel.org/stable/c/fb2ad0c1334a3eccfe4ed203f9eef5a4879226f6
https://lore.kernel.org/linux-cve-announce/2026050143-CVE-2026-31755-c004@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-31755
https://www.cve.org/CVERecord?id=CVE-2026-31755

History

Jul 4, 2026 12:15 PM Added references View changes

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/3cf0580a09d417eab41ce914a11f9cde3a121871

May 8, 2026 7:00 PM Affected versions updated View changes

Type	Values Removed	Values Added
CPEs		cpe:2.3:o:linux:linux_kernel:7.0:rc1:::::: cpe:2.3:o:linux:linux_kernel:7.0:rc2:::::: cpe:2.3:o:linux:linux_kernel:7.0:rc3:::::: cpe:2.3:o:linux:linux_kernel:7.0:rc4:::::: cpe:2.3:o:linux:linux_kernel:7.0:rc5:::::: cpe:2.3:o:linux:linux_kernel:7.0:rc6::::::

May 2, 2026 12:15 AM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-476
References		https://lore.kernel.org/linux-cve-announce/2026050143-CVE-2026-31755-c004@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-31755 https://www.cve.org/CVERecord?id=CVE-2026-31755
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

May 1, 2026 2:45 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: usb: cdns3: gadget: fix NULL pointer dereference in ep_queue When the gadget endpoint is disabled or not yet configured, the ep->desc pointer can be NULL. This leads to a NULL pointer dereference when __cdns3_gadget_ep_queue() is called, causing a kernel crash. Add a check to return -ESHUTDOWN if ep->desc is NULL, which is the standard return code for unconfigured endpoints. This prevents potential crashes when ep_queue is called on endpoints that are not ready.
Title		usb: cdns3: gadget: fix NULL pointer dereference in ep_queue
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/14bf08ab2cdfcdfd3f13e799d06692a1b3e0745f https://git.kernel.org/stable/c/390536cc6af4ca5566bc3bf1f8b704700380cd2c https://git.kernel.org/stable/c/3d1433fe34b224b90259e207e5389e95b504ef04 https://git.kernel.org/stable/c/7f6f127b9bc34bed35f56faf7ecb1561d6b39000 https://git.kernel.org/stable/c/9ab9b0e5fcdac325f950fc8b6caa08a9e22a0db9 https://git.kernel.org/stable/c/d61446dfc9d387775bb1b95b081953201b9222af https://git.kernel.org/stable/c/fb2ad0c1334a3eccfe4ed203f9eef5a4879226f6