In the Linux kernel, the following vulnerability has been resolved:

USB: gadget: fix NULL pointer dereference in gadget_dev_ioctl()

gadget_dev_ioctl() reads dev->gadget before acquiring dev->lock, but
dev->state is checked after acquiring the lock. Therefore a concurrent
bind can change the device state between these operations, which can
leave ioctl with a stale NULL gadget pointer and causing a NULL pointer
dereference at gadget->ops->ioctl.

Read dev->gadget while holding dev->lock so that the gadget pointer
and device state are sampled consistently.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 affected < 8be30959be31b4205e3bdd2e2a6221f3a2ee7ea1
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 affected < e8219accce2f6d3502ed71f5b5e854ecf27249a6
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 affected < 87cbf9410b12f5c2d659bb01e8ecf6517cb9f28c
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 affected < 162178ca83c3de986900385a0477eb539f8e1a7e
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 affected < ebd916fdfefaacbc0e577f7037ec96b31a105e5f
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 affected < c29a83c1ff3f06d5751f6d365b606c9f81ccc4cb
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 affected < 64ec019bf9a8b12f53b9f2777d65aadb730b5a84
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 affected < dd0eed9e165b1a6292f49e622e3dd0b7d99b106d
0 affected < 5.10.270
0 affected < 5.15.221
0 affected < 6.1.188
0 affected < 6.6.157
0 affected < 6.12.110
0 affected < 6.18.51
0 affected < 7.2.5
Linux Linux affected
Version Status Constraints
5.10.270 unaffected ≤ 5.10.*
5.15.221 unaffected ≤ 5.15.*
6.1.188 unaffected ≤ 6.1.*
6.6.157 unaffected ≤ 6.6.*
6.12.110 unaffected ≤ 6.12.*
6.18.51 unaffected ≤ 6.18.*
7.2.5 unaffected ≤ 7.2.*
7.3-rc2 unaffected ≤ *

No data.

No data.

No data.

Project Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/162178ca83c3de986900385a0477eb539f8e1a7e cve-icon cve-icon
https://git.kernel.org/stable/c/64ec019bf9a8b12f53b9f2777d65aadb730b5a84 cve-icon cve-icon
https://git.kernel.org/stable/c/87cbf9410b12f5c2d659bb01e8ecf6517cb9f28c cve-icon cve-icon
https://git.kernel.org/stable/c/8be30959be31b4205e3bdd2e2a6221f3a2ee7ea1 cve-icon cve-icon
https://git.kernel.org/stable/c/c29a83c1ff3f06d5751f6d365b606c9f81ccc4cb cve-icon cve-icon
https://git.kernel.org/stable/c/dd0eed9e165b1a6292f49e622e3dd0b7d99b106d cve-icon cve-icon
https://git.kernel.org/stable/c/e8219accce2f6d3502ed71f5b5e854ecf27249a6 cve-icon cve-icon
https://git.kernel.org/stable/c/ebd916fdfefaacbc0e577f7037ec96b31a105e5f cve-icon cve-icon
History

Wed, 16 Sep 2026 10:45:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: USB: gadget: fix NULL pointer dereference in gadget_dev_ioctl() gadget_dev_ioctl() reads dev->gadget before acquiring dev->lock, but dev->state is checked after acquiring the lock. Therefore a concurrent bind can change the device state between these operations, which can leave ioctl with a stale NULL gadget pointer and causing a NULL pointer dereference at gadget->ops->ioctl. Read dev->gadget while holding dev->lock so that the gadget pointer and device state are sampled consistently.
Title USB: gadget: fix NULL pointer dereference in gadget_dev_ioctl()
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-09-16T10:33:24.866Z

Reserved: 2026-09-11T19:38:34.781Z

Link: CVE-2026-90020

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-16T11:17:14.903

Modified: 2026-09-16T11:17:14.903

Link: CVE-2026-90020

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses

No weakness.