CVE-2026-98757

In the Linux kernel, the following vulnerability has been resolved: usb: cdns3: fix use-after-free in cdns3gadgetexit cdns3gadgetstart arms two works on systemfreezablewq: pendingstatuswq for the deferred ep0 status stage and alignedbufwq for realigned request buffers. Both handlers use the...

CVE-2026-98757

The Linux kernel contains a use-after-free vulnerability in the cdns3 gadget driver. The issue originates in cdns3_gadget_exit(), which fails to wait for two specific works (pending_status_wq and aligned_buf_wq) queued on system_freezable_wq. Because the function proceeds to free endpoints, buffe...

CVE-2026-98757 usb: cdns3: fix use-after-free in cdns3_gadget_exit()

In the Linux kernel, the following vulnerability has been resolved: usb: cdns3: fix use-after-free in cdns3gadgetexit cdns3gadgetstart arms two works on systemfreezablewq: pendingstatuswq for the deferred ep0 status stage and alignedbufwq for realigned request buffers. Both handlers use the...

CVE-2026-98756

In the Linux kernel, the following vulnerability has been resolved: usb: cdns3: Fix NULL pointer dereference in cdns3pciprobe The Cadence USBSS controller is a two-function PCI device. The first probed function allocates the driver data and stores it with pcisetdrvdata, while the second function...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: usb: cdns3: Fixed deadlock issue when using the NCM gadget The cdns3 driver suffers from the same deadlock issue as fixed in cdnsp with the commit 58f2fcb3a845 „usb: cdnsp: Fixed deadlock issue during use of the NCM gadget”. Unde...

ROS-20261013-73-0009

The vulnerability of the cdnsresume function in the drivers/usb/cdns3/core.c file of the Linux device driver framework relates to access to an uninitialized pointer. Exploiting this vulnerability could allow an attacker to cause a service failure...

ROS-20261008-73-0241

The vulnerability of the cdns3gadgetinit function in the drivers/usb/cdns3/cdns3-gadget.c driver for Linux USB device drivers is related to an incorrect definition of internal states. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: usb: cdns3 – Fix for use-after-free at workaround 2 BUG: KFENCE – Use-after-free during read operation in listdelentryvalid+0x10/0xac The code snippet is as follows: c cdns3wa2removeoldrequest … kfreeprivreq-request.buf;...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.10, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: usb: cdns3: gadget: fix NULL pointer dereference in epqueue When the gadget endpoint is disabled or not yet configured, the ep-desc pointer can be NULL. This can lead to a NULL pointer dereference when cdns3gadgetepqueue is calle...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerabilities have been resolved: usb: cdns3: Fixed a memory double-free issue when handling zero-length packets. 829: If request-complete, then: 830 spinunlock&privdev-lock; 831 usbgadgetgivebackrequest&privep-endpoint, 832 request; 833 spinlock&privdev-lock;...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: usb: cdns3: The part of the cdns set that activates the state should be placed outside the spin lock. The device may be scheduled during the resume process; therefore, this issue cannot occur in atomic operations. Since...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: usb: cdns3: Fix for a random warning message when loading drivers Warning log: 4.141392 Unexpected gfp: 0x4 GFPDMA32. Fixing it up to gfp: 0xa20 GFPATOMIC. Fix your code! 4.150340 CPU: 1 PID: 175 Comm: 1-0050 Not tainted...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: usb: cdns3: Fix for role switching during resume If the role changes while the system is suspended, the cdns3 driver switches to the new mode during resume. However, switching to the host mode in this context causes a NULL pointe...

EUVD-2026-32377

In the Linux kernel, the following vulnerability has been resolved: usb: cdns3: fix role switching during resume If the role change while we are suspended, the cdns3 driver switches to the new mode during resume. However, switching to host mode in this context causes a NULL pointer dereference. T...

CVE-2026-45911

In the Linux kernel, the following vulnerability has been resolved: usb: cdns3: fix role switching during resume If the role change while we are suspended, the cdns3 driver switches to the new mode during resume. However, switching to host mode in this context causes a NULL pointer dereference. T...

UBUNTU-CVE-2026-45911

In the Linux kernel, the following vulnerability has been resolved: usb: cdns3: fix role switching during resume If the role change while we are suspended, the cdns3 driver switches to the new mode during resume. However, switching to host mode in this context causes a NULL pointer dereference. T...

CVE-2026-31755

In the Linux kernel, the following vulnerability has been resolved: usb: cdns3: gadget: fix NULL pointer dereference in epqueue When the gadget endpoint is disabled or not yet configured, the ep-desc pointer can be NULL. This leads to a NULL pointer dereference when cdns3gadgetepqueue is called,...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from an inconsistent state of the usb cdns3 gadget driver upon initialization failure, which could lead to...

CVE-2026-31755: NULL Pointer Dereference

In the Linux kernel, the following vulnerability has been resolved: usb: cdns3: gadget: fix NULL pointer dereference in epqueue When the gadget endpoint is disabled or not yet configured, the ep-desc pointer can be NULL. This leads to a NULL pointer dereference when cdns3gadgetepqueue is called,...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2025-993039)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-993039 advisory. In the Linux kernel, the following vulnerability has been resolved: usb: cdns3: change place of 'privep' assignment in cdns3gadgetepdequeue, cdns3gadgetepenable If...