CVE-2026-31754

usb: cdns3: gadget: fix state inconsistency on gadget init failure

State: Published
Severity: Not scored
Published: May 1, 2026
Updated: May 11, 2026
Reserved: Mar 9, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

usb: cdns3: gadget: fix state inconsistency on gadget init failure

When cdns3_gadget_start() fails, the DRD hardware is left in gadget mode while software state remains INACTIVE, creating hardware/software state inconsistency.

When switching to host mode via sysfs: echo host > /sys/class/usb_role/13180000.usb-role-switch/role

The role state is not set to CDNS_ROLE_STATE_ACTIVE due to the error, so cdns_role_stop() skips cleanup because state is still INACTIVE. This violates the DRD controller design specification (Figure22), which requires returning to idle state before switching roles.

This leads to a synchronous external abort in xhci_gen_setup() when setting up the host controller:

[ 516.440698] configfs-gadget 13180000.usb: failed to start g1: -19 [ 516.442035] cdns-usb3 13180000.usb: Failed to add gadget [ 516.443278] cdns-usb3 13180000.usb: set role 2 has failed ... [ 1301.375722] xhci-hcd xhci-hcd.1.auto: xHCI Host Controller [ 1301.377716] Internal error: synchronous external abort: 96000010 [#1] PREEMPT SMP [ 1301.382485] pc : xhci_gen_setup+0xa4/0x408 [ 1301.393391] backtrace: ... xhci_gen_setup+0xa4/0x408 <-- CRASH xhci_plat_setup+0x44/0x58 usb_add_hcd+0x284/0x678 ... cdns_role_set+0x9c/0xbc <-- Role switch

Fix by calling cdns_drd_gadget_off() in the error path to properly clean up the DRD gadget state.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	7733f6c32e36ff9d7adadf40001039bf219b1cbe to before fb7110a052467098967284ef14d306810b354937Affected 7733f6c32e36ff9d7adadf40001039bf219b1cbe to before 9b1d301fbae837bf6979a19030b81d869bb15f7aAffected 7733f6c32e36ff9d7adadf40001039bf219b1cbe to before cfca84f5986afceb63a3adf39d4a98e915aebbc2Affected 7733f6c32e36ff9d7adadf40001039bf219b1cbe to before c7e475ae3a5593c5db21b3b7dca4ba8bdac9b47fAffected 7733f6c32e36ff9d7adadf40001039bf219b1cbe to before 5a85599ca4d2584d89dc69f4fc49303b75a42338Affected 7733f6c32e36ff9d7adadf40001039bf219b1cbe to before b490f0e477d26d29ed51e5dc47e3b9bd31bcb49fAffected 7733f6c32e36ff9d7adadf40001039bf219b1cbe to before c32f8748d70c8fc77676ad92ed76cede17bf2c48Affected
LinuxLinux	5.4Affected before 5.4Not affected 5.15.203 through 5.15.Not affected 6.1.168 through 6.1.Not affected 6.6.134 through 6.6.Not affected 6.12.81 through 6.12.Not affected 6.18.22 through 6.18.Not affected 6.19.12 through 6.19.Not affected 7.0 and laterNot affected

Product

Versions

LinuxLinux

7733f6c32e36ff9d7adadf40001039bf219b1cbe to before fb7110a052467098967284ef14d306810b354937Affected
7733f6c32e36ff9d7adadf40001039bf219b1cbe to before 9b1d301fbae837bf6979a19030b81d869bb15f7aAffected
7733f6c32e36ff9d7adadf40001039bf219b1cbe to before cfca84f5986afceb63a3adf39d4a98e915aebbc2Affected
7733f6c32e36ff9d7adadf40001039bf219b1cbe to before c7e475ae3a5593c5db21b3b7dca4ba8bdac9b47fAffected
7733f6c32e36ff9d7adadf40001039bf219b1cbe to before 5a85599ca4d2584d89dc69f4fc49303b75a42338Affected
7733f6c32e36ff9d7adadf40001039bf219b1cbe to before b490f0e477d26d29ed51e5dc47e3b9bd31bcb49fAffected
7733f6c32e36ff9d7adadf40001039bf219b1cbe to before c32f8748d70c8fc77676ad92ed76cede17bf2c48Affected

LinuxLinux

5.4Affected
before 5.4Not affected
5.15.203 through 5.15.*Not affected
6.1.168 through 6.1.*Not affected
6.6.134 through 6.6.*Not affected
6.12.81 through 6.12.*Not affected
6.18.22 through 6.18.*Not affected
6.19.12 through 6.19.*Not affected
7.0 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.