CVE-2026-97482 - Vulnerability Details

- usb: gadget: goku_udc: avoid NULL deref of dev->driver in INT_USBRESET log

Description

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: goku_udc: avoid NULL deref of dev->driver in INT_USBRESET log

goku_irq() handles a number of bus events under a single ep0 path.
It already guards the gadget driver suspend/resume callbacks against a
NULL ->driver:

if (dev->gadget.speed != USB_SPEED_UNKNOWN
&& dev->driver
&& dev->driver->resume) {
spin_unlock(&dev->lock);
dev->driver->resume(&dev->gadget);
...
}

but the very next branch unconditionally dereferences dev->driver
when an INT_USBRESET arrives:

if (stat & INT_USBRESET) {
ACK(INT_USBRESET);
INFO(dev, "USB reset done, gadget %s\n",
dev->driver->driver.name);
}

If the controller raises INT_USBRESET before any gadget driver has
been bound (or after one has been unbound), dev->driver is NULL and
the printk dereferences NULL.

smatch flags the inconsistency:

drivers/usb/gadget/udc/goku_udc.c:1618 goku_irq() error:
we previously assumed 'dev->driver' could be null (see line 1607)

Fall back to a placeholder when the gadget driver is not bound.

No functional change while a gadget driver is bound.

Published: 2026-09-24

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A null pointer dereference occurs in the goku_udc gadget driver when an INT_USBRESET interrupt is processed while no gadget driver is bound. The code unconditionally accesses dev->driver->driver.name, causing a kernel panic. This denial of service can bring the entire system to an unusable state, but it does not provide direct code execution or information disclosure.

Affected Systems

The flaw exists in the Linux kernel’s goku_udc driver, which supports the Goku USB Device Controller on devices that enable the gadget framework. Any Linux kernel build that includes goku_udc.c and has the gadget driver compiled could be affected; specific vulnerable versions are not listed, so consider all builds containing the original code path as potentially vulnerable.

Risk and Exploitability

Based on the description, it is inferred that an attacker who can trigger a USB reset event before a gadget driver is bound or after it has been unbound could cause a kernel panic. The CVSS score is 5.5, EPSS score is <1%, and the vulnerability is not listed in the CISA KEV catalog. Consequently, the exploitation probability is uncertain, but the impact of a kernel crash would lead to significant downtime. The vulnerability can be triggered by malicious USB devices or by exceeding kernel resources through abuse of USB class requests, as suggested in the discussion.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< d7b33afbf9b54b61cb423af9663df54eae11d3b1
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< ea2901a4a90afc662e4d023542d91f10ab10fd3c
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 999ff3bf665f2abfb6af519ef3d6d42b061d3c15
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< a018d4195114ca2cf79858cc45c98581dee4795b
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 10d7fc3008d5b7ec03af8e08927f1d090014c2af
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 28d78783a871cdb7a637dcb72452ff7d303430ae
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 5bf5e3fba9bc7dfd69701521dbe9809f8ccbdb02

Linux

affected

Version	Status	Constraints
`2.6.12`	affected	—
`0`	unaffected	< 2.6.12
`5.10.271`	unaffected	≤ 5.10.*
`5.15.222`	unaffected	≤ 5.15.*
`6.1.189`	unaffected	≤ 6.1.*
`6.6.158`	unaffected	≤ 6.6.*
`6.12.111`	unaffected	≤ 6.12.*
`6.18.53`	unaffected	≤ 6.18.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,10d7fc3008d5b7ec03af8e08927f1d090014c2af)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,28d78783a871cdb7a637dcb72452ff7d303430ae)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,5bf5e3fba9bc7dfd69701521dbe9809f8ccbdb02)`	affected	code_commit	—
`[0,6.12.111)`	affected	semver	—
`[0,6.18.53)`	affected	semver	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[6.12.111,6.13.0)`	unaffected	semver	—
`[6.18.53,6.19.0)`	unaffected	semver	—
`[7.2,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update the Linux kernel to a version that contains the goku_udc NULL dereference fix released in the 2026 kernel patch series.
If a kernel update is not possible, ensure that a gadget driver is bound before any USB reset events occur; avoid generating reset events when no driver is attached.
If the goku_udc driver is not required for your device, disable or remove it from the kernel configuration to eliminate the vulnerable code path.

Generated by OpenCVE AI on October 1, 2026 at 12:15 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4817-1	linux-6.12 security update
Debian DSA	DSA-6528-1	linux security update

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00173.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-97482.mbox
https://git.kernel.org/stable/c/10d7fc3008d5b7ec03af8e08927f1d090014c2af
https://git.kernel.org/stable/c/28d78783a871cdb7a637dcb72452ff7d303430ae
https://git.kernel.org/stable/c/5bf5e3fba9bc7dfd69701521dbe9809f8ccbdb02
https://git.kernel.org/stable/c/999ff3bf665f2abfb6af519ef3d6d42b061d3c15
https://git.kernel.org/stable/c/a018d4195114ca2cf79858cc45c98581dee4795b
https://git.kernel.org/stable/c/d7b33afbf9b54b61cb423af9663df54eae11d3b1
https://git.kernel.org/stable/c/ea2901a4a90afc662e4d023542d91f10ab10fd3c
https://nvd.nist.gov/vuln/detail/CVE-2026-97482
https://www.cve.org/CVERecord?id=CVE-2026-97482

History

Sat, 03 Oct 2026 11:15:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/999ff3bf665f2abfb6af519ef3d6d42b061d3c15 https://git.kernel.org/stable/c/a018d4195114ca2cf79858cc45c98581dee4795b https://git.kernel.org/stable/c/d7b33afbf9b54b61cb423af9663df54eae11d3b1 https://git.kernel.org/stable/c/ea2901a4a90afc662e4d023542d91f10ab10fd3c

Wed, 30 Sep 2026 00:15:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-97482.mbox https://nvd.nist.gov/vuln/detail/CVE-2026-97482 https://www.cve.org/CVERecord?id=CVE-2026-97482
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Fri, 25 Sep 2026 03:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-476

Thu, 24 Sep 2026 16:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: usb: gadget: goku_udc: avoid NULL deref of dev->driver in INT_USBRESET log goku_irq() handles a number of bus events under a single ep0 path. It already guards the gadget driver suspend/resume callbacks against a NULL ->driver: if (dev->gadget.speed != USB_SPEED_UNKNOWN && dev->driver && dev->driver->resume) { spin_unlock(&dev->lock); dev->driver->resume(&dev->gadget); ... } but the very next branch unconditionally dereferences dev->driver when an INT_USBRESET arrives: if (stat & INT_USBRESET) { ACK(INT_USBRESET); INFO(dev, "USB reset done, gadget %s\n", dev->driver->driver.name); } If the controller raises INT_USBRESET before any gadget driver has been bound (or after one has been unbound), dev->driver is NULL and the printk dereferences NULL. smatch flags the inconsistency: drivers/usb/gadget/udc/goku_udc.c:1618 goku_irq() error: we previously assumed 'dev->driver' could be null (see line 1607) Fall back to a placeholder when the gadget driver is not bound. No functional change while a gadget driver is bound.
Title		usb: gadget: goku_udc: avoid NULL deref of dev->driver in INT_USBRESET log
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/10d7fc3008d5b7ec03af8e08927f1d090014c2af https://git.kernel.org/stable/c/28d78783a871cdb7a637dcb72452ff7d303430ae https://git.kernel.org/stable/c/5bf5e3fba9bc7dfd69701521dbe9809f8ccbdb02

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-24T16:04:25.874Z

Updated: 2026-10-03T10:58:46.364Z

Reserved: 2026-09-24T16:01:01.149Z

Link: CVE-2026-97482

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-24T17:17:25.707

Modified: 2026-10-03T11:17:58.110

Link: CVE-2026-97482

Redhat

Severity : Moderate

Publid Date: 2026-09-24T00:00:00Z

Links: CVE-2026-97482 - Bugzilla

OpenCVE Enrichment

Updated: 2026-10-01T12:30:07Z

Weaknesses

CWE-476
NULL Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object