In the Linux kernel, the following vulnerability has been resolved: usb: cdns3: Fix NULL pointer dereference in cdns3_pci_probe The Cadence USBSS… (CVE-2026-98756)

The vulnerability in the Linux kernel's cdns3 driver arises because the Cadence USBSS controller is a two-function PCI device where the first function allocates driver data and the second function reuses it. If the second function probes while the first function is enabled but has not yet set its driver data, pci_get_drvdata() returns NULL. This leads to a NULL pointer dereference when the driver attempts to assign wrap->devfn, crashing the kernel. The resolution is to return -EPROBE_DEFER in this scenario, deferring the probe until the first function's probe completes.

This vulnerability can cause a kernel crash (denial of service) due to a NULL pointer dereference during device probing. There is no indication of code execution or privilege escalation from the provided data.

A fix has been implemented in the Linux kernel to return -EPROBE_DEFER when the second function probes before the first function has set its driver data, preventing the NULL pointer dereference. Users should update to a kernel version that includes this fix. Patch status is not explicitly confirmed in the input; check the vendor advisory or Linux kernel changelogs for the exact fixed version.