CVE-2026-90020

USB: gadget: fix NULL pointer dereference in gadget_dev_ioctl()

State: Published
Severity: Not scored
Published: Sep 16, 2026
Updated: Oct 19, 2026
Reserved: Sep 11, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

USB: gadget: fix NULL pointer dereference in gadget_dev_ioctl()

gadget_dev_ioctl() reads dev->gadget before acquiring dev->lock, but dev->state is checked after acquiring the lock. Therefore a concurrent bind can change the device state between these operations, which can leave ioctl with a stale NULL gadget pointer and causing a NULL pointer dereference at gadget->ops->ioctl.

Read dev->gadget while holding dev->lock so that the gadget pointer and device state are sampled consistently.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 8be30959be31b4205e3bdd2e2a6221f3a2ee7ea1Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before e8219accce2f6d3502ed71f5b5e854ecf27249a6Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 87cbf9410b12f5c2d659bb01e8ecf6517cb9f28cAffected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 162178ca83c3de986900385a0477eb539f8e1a7eAffected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before ebd916fdfefaacbc0e577f7037ec96b31a105e5fAffected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before c29a83c1ff3f06d5751f6d365b606c9f81ccc4cbAffected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 64ec019bf9a8b12f53b9f2777d65aadb730b5a84Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before dd0eed9e165b1a6292f49e622e3dd0b7d99b106dAffected
LinuxLinux	2.6.12Affected before 2.6.12Not affected 5.10.270 through 5.10.Not affected 5.15.221 through 5.15.Not affected 6.1.188 through 6.1.Not affected 6.6.157 through 6.6.Not affected 6.12.110 through 6.12.Not affected 6.18.51 through 6.18.Not affected 7.2.5 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 8be30959be31b4205e3bdd2e2a6221f3a2ee7ea1Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before e8219accce2f6d3502ed71f5b5e854ecf27249a6Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 87cbf9410b12f5c2d659bb01e8ecf6517cb9f28cAffected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 162178ca83c3de986900385a0477eb539f8e1a7eAffected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before ebd916fdfefaacbc0e577f7037ec96b31a105e5fAffected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before c29a83c1ff3f06d5751f6d365b606c9f81ccc4cbAffected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 64ec019bf9a8b12f53b9f2777d65aadb730b5a84Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before dd0eed9e165b1a6292f49e622e3dd0b7d99b106dAffected

LinuxLinux

2.6.12Affected
before 2.6.12Not affected
5.10.270 through 5.10.*Not affected
5.15.221 through 5.15.*Not affected
6.1.188 through 6.1.*Not affected
6.6.157 through 6.6.*Not affected
6.12.110 through 6.12.*Not affected
6.18.51 through 6.18.*Not affected
7.2.5 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.