CVE-2026-31755

usb: cdns3: gadget: fix NULL pointer dereference in ep_queue

State: Published
Severity: Not scored
Published: May 1, 2026
Updated: Jul 4, 2026
Reserved: Mar 9, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

usb: cdns3: gadget: fix NULL pointer dereference in ep_queue

When the gadget endpoint is disabled or not yet configured, the ep->desc pointer can be NULL. This leads to a NULL pointer dereference when __cdns3_gadget_ep_queue() is called, causing a kernel crash.

Add a check to return -ESHUTDOWN if ep->desc is NULL, which is the standard return code for unconfigured endpoints.

This prevents potential crashes when ep_queue is called on endpoints that are not ready.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	7733f6c32e36ff9d7adadf40001039bf219b1cbe to before 3cf0580a09d417eab41ce914a11f9cde3a121871Affected 7733f6c32e36ff9d7adadf40001039bf219b1cbe to before 3d1433fe34b224b90259e207e5389e95b504ef04Affected 7733f6c32e36ff9d7adadf40001039bf219b1cbe to before fb2ad0c1334a3eccfe4ed203f9eef5a4879226f6Affected 7733f6c32e36ff9d7adadf40001039bf219b1cbe to before 9ab9b0e5fcdac325f950fc8b6caa08a9e22a0db9Affected 7733f6c32e36ff9d7adadf40001039bf219b1cbe to before d61446dfc9d387775bb1b95b081953201b9222afAffected 7733f6c32e36ff9d7adadf40001039bf219b1cbe to before 390536cc6af4ca5566bc3bf1f8b704700380cd2cAffected 7733f6c32e36ff9d7adadf40001039bf219b1cbe to before 14bf08ab2cdfcdfd3f13e799d06692a1b3e0745fAffected 7733f6c32e36ff9d7adadf40001039bf219b1cbe to before 7f6f127b9bc34bed35f56faf7ecb1561d6b39000Affected
LinuxLinux	5.4Affected before 5.4Not affected 5.10.260 through 5.10.Not affected 5.15.203 through 5.15.Not affected 6.1.168 through 6.1.Not affected 6.6.134 through 6.6.Not affected 6.12.81 through 6.12.Not affected 6.18.22 through 6.18.Not affected 6.19.12 through 6.19.*Not affected 7.0 and laterNot affected

Product

Versions

LinuxLinux

7733f6c32e36ff9d7adadf40001039bf219b1cbe to before 3cf0580a09d417eab41ce914a11f9cde3a121871Affected
7733f6c32e36ff9d7adadf40001039bf219b1cbe to before 3d1433fe34b224b90259e207e5389e95b504ef04Affected
7733f6c32e36ff9d7adadf40001039bf219b1cbe to before fb2ad0c1334a3eccfe4ed203f9eef5a4879226f6Affected
7733f6c32e36ff9d7adadf40001039bf219b1cbe to before 9ab9b0e5fcdac325f950fc8b6caa08a9e22a0db9Affected
7733f6c32e36ff9d7adadf40001039bf219b1cbe to before d61446dfc9d387775bb1b95b081953201b9222afAffected
7733f6c32e36ff9d7adadf40001039bf219b1cbe to before 390536cc6af4ca5566bc3bf1f8b704700380cd2cAffected
7733f6c32e36ff9d7adadf40001039bf219b1cbe to before 14bf08ab2cdfcdfd3f13e799d06692a1b3e0745fAffected
7733f6c32e36ff9d7adadf40001039bf219b1cbe to before 7f6f127b9bc34bed35f56faf7ecb1561d6b39000Affected

LinuxLinux

5.4Affected
before 5.4Not affected
5.10.260 through 5.10.*Not affected
5.15.203 through 5.15.*Not affected
6.1.168 through 6.1.*Not affected
6.6.134 through 6.6.*Not affected
6.12.81 through 6.12.*Not affected
6.18.22 through 6.18.*Not affected
6.19.12 through 6.19.*Not affected
7.0 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.