CVE-2026-45911 - Vulnerability Details

- usb: cdns3: fix role switching during resume

Description

In the Linux kernel, the following vulnerability has been resolved:

usb: cdns3: fix role switching during resume

If the role change while we are suspended, the cdns3 driver switches to the
new mode during resume. However, switching to host mode in this context
causes a NULL pointer dereference.

The host role's start() operation registers a xhci-hcd device, but its
probe is deferred while we are in the resume path. The host role's resume()
operation assumes the xhci-hcd device is already probed, which is not the
case, leading to the dereference. Since the start() operation of the new
role is already called, the resume operation can be skipped.

So skip the resume operation for the new role if a role switch occurs
during resume. Once the resume sequence is complete, the xhci-hcd device
can be probed in case of host mode.

Unable to handle kernel NULL pointer dereference at virtual address 0000000000000208
Mem abort info:
...
Data abort info:
...
[0000000000000208] pgd=0000000000000000, p4d=0000000000000000
Internal error: Oops: 0000000096000004 [#1] SMP
Modules linked in:
CPU: 0 UID: 0 PID: 146 Comm: sh Not tainted
6.19.0-rc7-00013-g6e64f4aabfae-dirty #135 PREEMPT
Hardware name: Texas Instruments J7200 EVM (DT)
pstate: 20000005 (nzCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : usb_hcd_is_primary_hcd+0x0/0x1c
lr : cdns_host_resume+0x24/0x5c
...
Call trace:
usb_hcd_is_primary_hcd+0x0/0x1c (P)
cdns_resume+0x6c/0xbc
cdns3_controller_resume.isra.0+0xe8/0x17c
cdns3_plat_resume+0x18/0x24
platform_pm_resume+0x2c/0x68
dpm_run_callback+0x90/0x248
device_resume+0x100/0x24c
dpm_resume+0x190/0x2ec
dpm_resume_end+0x18/0x34
suspend_devices_and_enter+0x2b0/0xa44
pm_suspend+0x16c/0x5fc
state_store+0x80/0xec
kobj_attr_store+0x18/0x2c
sysfs_kf_write+0x7c/0x94
kernfs_fop_write_iter+0x130/0x1dc
vfs_write+0x240/0x370
ksys_write+0x70/0x108
__arm64_sys_write+0x1c/0x28
invoke_syscall+0x48/0x10c
el0_svc_common.constprop.0+0x40/0xe0
do_el0_svc+0x1c/0x28
el0_svc+0x34/0x108
el0t_64_sync_handler+0xa0/0xe4
el0t_64_sync+0x198/0x19c
Code: 52800003 f9407ca5 d63f00a0 17ffffe4 (f9410401)
---[ end trace 0000000000000000 ]---

Published: 2026-05-27

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The bug exists in the Linux cdns3 USB driver. When the system resumes from suspension and the USB role changes to host mode, the driver mistakenly attempts to use an xhci‑hcd device that has not yet been fully probed, resulting in a null pointer dereference (CWE‑824). This causes a kernel Oops and system crash, leading to a denial of availability.

Affected Systems

The problem affects Linux kernel builds that include the cdns3 driver, such as the 6.19.0‑rc7 kernel used on the Texas Instruments J7200 EVM. Any system that uses the cdns3 driver and can suspend/resume with a role change is vulnerable. No specific product name is listed beyond the generic Linux kernel, but devices with the cdns3 driver (e.g., embedded ARM boards) are impacted.

Risk and Exploitability

The CVSS score is 5.5, indicating a moderate severity. The EPSS score is < 1%, and the vulnerability is not listed in the CISA KEV catalog. The flaw is only exploitable in local suspend/resume scenarios where a role switch occurs between suspend and resume, so the attack vector is local. Because the bug leads to a kernel crash, it can be exploited to cause a denial of service, but the attack requires local access and a vulnerable platform with the cdns3 driver. This flaw is described as a null pointer dereference (CWE‑824).

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`2cf2581cd2290ccef674f1be5f7977d66702eedb`	affected	< ff02bd303d2d78051771db51119d66c0cf442f47
`2cf2581cd2290ccef674f1be5f7977d66702eedb`	affected	< 94c742614899ff18a6b3e6f3cfbe7b9f36c865f3
`2cf2581cd2290ccef674f1be5f7977d66702eedb`	affected	< d637f6ec149ffd2f8257bcc261561dc2e44dbb8c
`2cf2581cd2290ccef674f1be5f7977d66702eedb`	affected	< 56289298431ed76700b9aac27a3b1d929fe61b8d
`2cf2581cd2290ccef674f1be5f7977d66702eedb`	affected	< fc086c0ce3db0eefbbeb66a5b1e626296336e33a
`2cf2581cd2290ccef674f1be5f7977d66702eedb`	affected	< 49c99dc247ebf7361db9dbdade3dcebfffaf2c22
`2cf2581cd2290ccef674f1be5f7977d66702eedb`	affected	< 87e4b043b98a1d269be0b812f383881abee0ca45

Linux

affected

Version	Status	Constraints
`5.13`	affected	—
`0`	unaffected	< 5.13
`5.15.203`	unaffected	≤ 5.15.*
`6.1.167`	unaffected	≤ 6.1.*
`6.6.130`	unaffected	≤ 6.6.*
`6.12.77`	unaffected	≤ 6.12.*
`6.18.14`	unaffected	≤ 6.18.*
`6.19.4`	unaffected	≤ 6.19.*
`7.0`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[2cf2581cd2290ccef674f1be5f7977d66702eedb,ff02bd303d2d78051771db51119d66c0cf442f47)`	affected	code_commit	—
`[2cf2581cd2290ccef674f1be5f7977d66702eedb,94c742614899ff18a6b3e6f3cfbe7b9f36c865f3)`	affected	code_commit	—
`[2cf2581cd2290ccef674f1be5f7977d66702eedb,d637f6ec149ffd2f8257bcc261561dc2e44dbb8c)`	affected	code_commit	—
`[2cf2581cd2290ccef674f1be5f7977d66702eedb,56289298431ed76700b9aac27a3b1d929fe61b8d)`	affected	code_commit	—
`[2cf2581cd2290ccef674f1be5f7977d66702eedb,fc086c0ce3db0eefbbeb66a5b1e626296336e33a)`	affected	code_commit	—
`[2cf2581cd2290ccef674f1be5f7977d66702eedb,49c99dc247ebf7361db9dbdade3dcebfffaf2c22)`	affected	code_commit	—
`[2cf2581cd2290ccef674f1be5f7977d66702eedb,87e4b043b98a1d269be0b812f383881abee0ca45)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`5.13`	affected	generic	—
`[0,5.13)`	unaffected	semver	—
`[5.15.203,5.15.*]`	unaffected	generic	—
`[6.1.167,6.1.*]`	unaffected	generic	—
`[6.6.130,6.6.*]`	unaffected	generic	—
`[6.12.77,6.12.*]`	unaffected	generic	—
`[6.18.14,6.18.*]`	unaffected	generic	—
`[6.19.4,6.19.*]`	unaffected	generic	—
`[0,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Update the Linux kernel to a version that includes the cdns3 driver role‑switching fix.
For systems that cannot be updated immediately, avoid suspending the device when a role change is pending, or disable role switching if the platform allows.
Monitor dmesg and system logs for signs of kernel Oops; reboot promptly if a crash occurs.

Generated by OpenCVE AI on May 28, 2026 at 17:16 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00205.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/49c99dc247ebf7361db9dbdade3dcebfffaf2c22
https://git.kernel.org/stable/c/56289298431ed76700b9aac27a3b1d929fe61b8d
https://git.kernel.org/stable/c/87e4b043b98a1d269be0b812f383881abee0ca45
https://git.kernel.org/stable/c/94c742614899ff18a6b3e6f3cfbe7b9f36c865f3
https://git.kernel.org/stable/c/d637f6ec149ffd2f8257bcc261561dc2e44dbb8c
https://git.kernel.org/stable/c/fc086c0ce3db0eefbbeb66a5b1e626296336e33a
https://git.kernel.org/stable/c/ff02bd303d2d78051771db51119d66c0cf442f47
https://lore.kernel.org/linux-cve-announce/2026052722-CVE-2026-45911-ebbe@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-45911
https://www.cve.org/CVERecord?id=CVE-2026-45911

History

Thu, 28 May 2026 16:45:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-476

Thu, 28 May 2026 12:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-824
References		https://lore.kernel.org/linux-cve-announce/2026052722-CVE-2026-45911-ebbe@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-45911 https://www.cve.org/CVERecord?id=CVE-2026-45911
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Low`

Wed, 27 May 2026 18:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-476

Wed, 27 May 2026 14:15:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: usb: cdns3: fix role switching during resume If the role change while we are suspended, the cdns3 driver switches to the new mode during resume. However, switching to host mode in this context causes a NULL pointer dereference. The host role's start() operation registers a xhci-hcd device, but its probe is deferred while we are in the resume path. The host role's resume() operation assumes the xhci-hcd device is already probed, which is not the case, leading to the dereference. Since the start() operation of the new role is already called, the resume operation can be skipped. So skip the resume operation for the new role if a role switch occurs during resume. Once the resume sequence is complete, the xhci-hcd device can be probed in case of host mode. Unable to handle kernel NULL pointer dereference at virtual address 0000000000000208 Mem abort info: ... Data abort info: ... [0000000000000208] pgd=0000000000000000, p4d=0000000000000000 Internal error: Oops: 0000000096000004 [#1] SMP Modules linked in: CPU: 0 UID: 0 PID: 146 Comm: sh Not tainted 6.19.0-rc7-00013-g6e64f4aabfae-dirty #135 PREEMPT Hardware name: Texas Instruments J7200 EVM (DT) pstate: 20000005 (nzCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : usb_hcd_is_primary_hcd+0x0/0x1c lr : cdns_host_resume+0x24/0x5c ... Call trace: usb_hcd_is_primary_hcd+0x0/0x1c (P) cdns_resume+0x6c/0xbc cdns3_controller_resume.isra.0+0xe8/0x17c cdns3_plat_resume+0x18/0x24 platform_pm_resume+0x2c/0x68 dpm_run_callback+0x90/0x248 device_resume+0x100/0x24c dpm_resume+0x190/0x2ec dpm_resume_end+0x18/0x34 suspend_devices_and_enter+0x2b0/0xa44 pm_suspend+0x16c/0x5fc state_store+0x80/0xec kobj_attr_store+0x18/0x2c sysfs_kf_write+0x7c/0x94 kernfs_fop_write_iter+0x130/0x1dc vfs_write+0x240/0x370 ksys_write+0x70/0x108 __arm64_sys_write+0x1c/0x28 invoke_syscall+0x48/0x10c el0_svc_common.constprop.0+0x40/0xe0 do_el0_svc+0x1c/0x28 el0_svc+0x34/0x108 el0t_64_sync_handler+0xa0/0xe4 el0t_64_sync+0x198/0x19c Code: 52800003 f9407ca5 d63f00a0 17ffffe4 (f9410401) ---[ end trace 0000000000000000 ]---
Title		usb: cdns3: fix role switching during resume
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/49c99dc247ebf7361db9dbdade3dcebfffaf2c22 https://git.kernel.org/stable/c/56289298431ed76700b9aac27a3b1d929fe61b8d https://git.kernel.org/stable/c/87e4b043b98a1d269be0b812f383881abee0ca45 https://git.kernel.org/stable/c/94c742614899ff18a6b3e6f3cfbe7b9f36c865f3 https://git.kernel.org/stable/c/d637f6ec149ffd2f8257bcc261561dc2e44dbb8c https://git.kernel.org/stable/c/fc086c0ce3db0eefbbeb66a5b1e626296336e33a https://git.kernel.org/stable/c/ff02bd303d2d78051771db51119d66c0cf442f47

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-05-27T12:17:26.924Z

Updated: 2026-05-27T12:17:26.924Z

Reserved: 2026-05-13T15:03:33.084Z

Link: CVE-2026-45911

Vulnrichment

No data.

NVD

Status : Awaiting Analysis

Published: 2026-05-27T14:17:05.687

Modified: 2026-06-17T10:52:42.923

Link: CVE-2026-45911

Redhat

Severity : Low

Publid Date: 2026-05-27T00:00:00Z

Links: CVE-2026-45911 - Bugzilla

OpenCVE Enrichment

Updated: 2026-05-28T17:30:15Z

Weaknesses

CWE-824
Access of Uninitialized Pointer

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object