CVE-2026-90019

usb: gadget: fix null pointer dereference in usb_put_function_instance()

State: Published
Severity: Not scored
Published: Sep 16, 2026
Updated: Oct 19, 2026
Reserved: Sep 11, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: fix null pointer dereference in usb_put_function_instance()

usb_put_function_instance() attempts to dereference fd inside fi struct to get mod in uvc_alloc_inst() error path. However, fd is not allocated until later in try_get_usb_function_instance() after allocating fi in uvc_alloc_inst() and thus guranteed to be null in error path. Fix this by adding a null check for fi->fd that returns if fd is null.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	0062f6e56f70bd2230ba1ebd1667d1b32a1af3b2 to before 0fc54a00954f9f4c3e3d4ffa64a530685d99a39bAffected 0062f6e56f70bd2230ba1ebd1667d1b32a1af3b2 to before 6e6736c049683380f5e20becde498986e9293ca4Affected 0062f6e56f70bd2230ba1ebd1667d1b32a1af3b2 to before 3a9691fff79bcce95338435599df6d3ae433cfdcAffected 0062f6e56f70bd2230ba1ebd1667d1b32a1af3b2 to before 7a4f4ca7ff32ae24807c83e2a06d62b13378d53cAffected 0062f6e56f70bd2230ba1ebd1667d1b32a1af3b2 to before 6ea3a073ca97716d4a73df49a3bec1c3ccf8e2a0Affected 0062f6e56f70bd2230ba1ebd1667d1b32a1af3b2 to before d3a7fa61997db3bf6dadef4c1bd87a4fa782a817Affected 0062f6e56f70bd2230ba1ebd1667d1b32a1af3b2 to before 5117f236e9e30744338b425395d55913c4500897Affected 0062f6e56f70bd2230ba1ebd1667d1b32a1af3b2 to before 6e74ac5c596fd246e37eadfc354567179ccbe9aaAffected
LinuxLinux	3.9Affected before 3.9Not affected 5.10.270 through 5.10.Not affected 5.15.221 through 5.15.Not affected 6.1.188 through 6.1.Not affected 6.6.157 through 6.6.Not affected 6.12.110 through 6.12.Not affected 6.18.51 through 6.18.Not affected 7.2.5 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

0062f6e56f70bd2230ba1ebd1667d1b32a1af3b2 to before 0fc54a00954f9f4c3e3d4ffa64a530685d99a39bAffected
0062f6e56f70bd2230ba1ebd1667d1b32a1af3b2 to before 6e6736c049683380f5e20becde498986e9293ca4Affected
0062f6e56f70bd2230ba1ebd1667d1b32a1af3b2 to before 3a9691fff79bcce95338435599df6d3ae433cfdcAffected
0062f6e56f70bd2230ba1ebd1667d1b32a1af3b2 to before 7a4f4ca7ff32ae24807c83e2a06d62b13378d53cAffected
0062f6e56f70bd2230ba1ebd1667d1b32a1af3b2 to before 6ea3a073ca97716d4a73df49a3bec1c3ccf8e2a0Affected
0062f6e56f70bd2230ba1ebd1667d1b32a1af3b2 to before d3a7fa61997db3bf6dadef4c1bd87a4fa782a817Affected
0062f6e56f70bd2230ba1ebd1667d1b32a1af3b2 to before 5117f236e9e30744338b425395d55913c4500897Affected
0062f6e56f70bd2230ba1ebd1667d1b32a1af3b2 to before 6e74ac5c596fd246e37eadfc354567179ccbe9aaAffected

LinuxLinux

3.9Affected
before 3.9Not affected
5.10.270 through 5.10.*Not affected
5.15.221 through 5.15.*Not affected
6.1.188 through 6.1.*Not affected
6.6.157 through 6.6.*Not affected
6.12.110 through 6.12.*Not affected
6.18.51 through 6.18.*Not affected
7.2.5 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.