A vulnerability in the Linux kernel's cdns3 USB gadget driver can cause a NULL pointer dereference leading to a kernel crash. (CVE-2026-31755)
A vulnerability in the Linux kernel's cdns3 USB gadget driver can cause a NULL pointer dereference leading to a kernel crash. This occurs when the gadget endpoint is disabled or not yet configured, resulting in a NULL ep->desc pointer. The issue is fixed by adding a check to return -ESHUTDOWN if ep->desc is NULL, preventing crashes when ep_queue is called on unready endpoints.
AI Analysis
Technical Summary
The Linux kernel cdns3 USB gadget driver had a vulnerability where the ep->desc pointer could be NULL if the gadget endpoint was disabled or unconfigured. Calling __cdns3_gadget_ep_queue() in this state caused a NULL pointer dereference and kernel crash. The fix involves adding a check to return -ESHUTDOWN when ep->desc is NULL, which is the standard return for unconfigured endpoints, thereby preventing the crash.
Potential Impact
This vulnerability leads to a denial of service via a kernel crash (NULL pointer dereference) when the affected function is called on unconfigured or disabled USB gadget endpoints. There is no impact on confidentiality or integrity.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The fix described involves adding a NULL check to return -ESHUTDOWN for unconfigured endpoints. Until a patch is applied, avoid triggering the vulnerable code path by not calling ep_queue on disabled or unconfigured endpoints.
A vulnerability in the Linux kernel's cdns3 USB gadget driver can cause a NULL pointer dereference leading to a kernel crash. (CVE-2026-31755)
Description
A vulnerability in the Linux kernel's cdns3 USB gadget driver can cause a NULL pointer dereference leading to a kernel crash. This occurs when the gadget endpoint is disabled or not yet configured, resulting in a NULL ep->desc pointer. The issue is fixed by adding a check to return -ESHUTDOWN if ep->desc is NULL, preventing crashes when ep_queue is called on unready endpoints.
CVSS v3.1
Score 5.5medium
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Linux kernel cdns3 USB gadget driver had a vulnerability where the ep->desc pointer could be NULL if the gadget endpoint was disabled or unconfigured. Calling __cdns3_gadget_ep_queue() in this state caused a NULL pointer dereference and kernel crash. The fix involves adding a check to return -ESHUTDOWN when ep->desc is NULL, which is the standard return for unconfigured endpoints, thereby preventing the crash.
Potential Impact
This vulnerability leads to a denial of service via a kernel crash (NULL pointer dereference) when the affected function is called on unconfigured or disabled USB gadget endpoints. There is no impact on confidentiality or integrity.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The fix described involves adding a NULL check to return -ESHUTDOWN for unconfigured endpoints. Until a patch is applied, avoid triggering the vulnerable code path by not calling ep_queue on disabled or unconfigured endpoints.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-5r68-rpxc-f6cw
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-31755"]
- Ecosystems
- []
- Database Specific Severity
- MODERATE
- Cvss Version
- 3.1
Threat ID: 6a498a7b27e9c7971936f6c8
Added to database: 07/04/2026, 22:34:35 UTC
Last enriched: 07/04/2026, 23:06:55 UTC
Last updated: 07/31/2026, 19:24:46 UTC
Views: 11
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.