CVE-2026-31754: Linux Kernel USB CDNS3 DoS Vulnerability

CVE-2026-31754 Overview

CVE-2026-31754 is a Linux kernel vulnerability in the Cadence USB3 (cdns3) gadget driver. When cdns3_gadget_start() fails during initialization, the Dual-Role Device (DRD) hardware remains in gadget mode while the software state stays INACTIVE. This creates a hardware/software state inconsistency that violates the DRD controller design specification, which requires the controller to return to idle before switching roles. Subsequent role transitions through sysfs trigger a synchronous external abort in xhci_gen_setup(), crashing the kernel.

Critical Impact
A failed gadget initialization combined with a USB role switch to host mode produces a synchronous external abort in the xHCI host controller setup path, leading to a kernel crash and denial of service on affected systems.

Affected Products

Linux kernel versions containing the cdns3 USB gadget driver prior to the fix
Systems using the Cadence USB3 DRD controller (for example, devices with 13180000.usb-role-switch)
Stable kernel branches referenced by commits 5a85599c, 9b1d301f, b490f0e4, c32f8748, c7e475ae, cfca84f5, and fb7110a0

Discovery Timeline

2026-05-01 - CVE-2026-31754 published to NVD
2026-05-01 - Last updated in NVD database

Technical Details for CVE-2026-31754

Vulnerability Analysis

The defect lives in the Cadence USB3 gadget driver cdns3, used by the Linux kernel to manage DRD controllers that switch between host and gadget roles. When cdns3_gadget_start() returns an error, the driver fails to roll back the hardware role transition that already placed the controller in gadget mode. The internal role state never advances to CDNS_ROLE_STATE_ACTIVE, so the cleanup path in cdns_role_stop() is skipped.

When a user later writes host to /sys/class/usb_role/13180000.usb-role-switch/role, the controller attempts to bring up the xHCI host driver while the underlying hardware is still configured for gadget operation. The mismatched configuration causes xhci_gen_setup() to access registers that are not valid in the current hardware mode, generating a synchronous external abort (96000010) and a kernel oops.

Root Cause

The root cause is missing error-path cleanup in the gadget initialization routine. The function leaves the DRD hardware in gadget mode without informing the role-management state machine. This is a kernel driver state-management defect that produces an inconsistent view between firmware and software layers.

Attack Vector

Exploitation requires local access and the ability to write to the USB role switch sysfs interface, which is typically restricted to privileged users. The attack sequence requires cdns3_gadget_start() to fail, for example through a misconfigured configfs-gadget, followed by a role switch from gadget to host. The result is a kernel crash and denial of service rather than code execution. No proof-of-concept exploit is publicly available, and the EPSS data reflects a low likelihood of in-the-wild exploitation.

The fix calls cdns_drd_gadget_off() in the error path of cdns3_gadget_start() so that the DRD hardware returns to idle and the software state is consistent before any subsequent role change.

Detection Methods for CVE-2026-31754

Indicators of Compromise

Kernel log entries containing failed to start g1: -19 followed by Failed to add gadget and set role 2 has failed from the cdns-usb3 driver.
Internal error: synchronous external abort: 96000010 with a backtrace referencing xhci_gen_setup, xhci_plat_setup, usb_add_hcd, and cdns_role_set.
Unexpected kernel panics on systems performing USB role transitions through /sys/class/usb_role/*/role.

Detection Strategies

Monitor dmesg and journald for the error string sequence emitted by the configfs-gadget and cdns-usb3 subsystems immediately before a crash.
Inventory running kernels against the fixed commits listed in the kernel.org references and flag hosts running unpatched versions of the cdns3 driver.
Correlate USB role switch writes with kernel exception events in centralized logging to identify suspect sequences.

Monitoring Recommendations

Forward kernel logs from embedded and edge devices using the Cadence USB3 controller to a central log platform for retention and search.
Alert on synchronous external abort messages tied to USB host controller initialization paths.
Track the build and patch level of the kernel package across the device fleet to ensure coverage.

How to Mitigate CVE-2026-31754

Immediate Actions Required

Apply the upstream Linux kernel patches referenced by commits Kernel Git Commit b490f0e and the related stable backports.
Restrict write access to /sys/class/usb_role/*/role to root only and audit any user-space services that perform role transitions.
Validate that configfs-gadget configurations are correct before enabling the gadget to reduce the chance that cdns3_gadget_start() fails.

Patch Information

The fix adds a call to cdns_drd_gadget_off() in the error path of cdns3_gadget_start(), returning the DRD controller to idle when gadget initialization fails. Stable backports are available in the kernel.org references, including Kernel Git Commit 5a85599, Kernel Git Commit 9b1d301f, Kernel Git Commit c32f8748, Kernel Git Commit c7e475ae, Kernel Git Commit cfca84f5, and Kernel Git Commit fb7110a0.

Workarounds

Avoid switching USB roles at runtime on systems using the cdns3 driver until patched kernels are deployed.
Disable or unload the cdns3 gadget driver on devices that do not require gadget mode.
Validate gadget configurations through configfs before binding to prevent the failure path that triggers the inconsistency.

bash

# Verify kernel version and check for the fix in the cdns3 driver
uname -r
modinfo cdns3 | grep -E 'filename|version'

# Restrict access to the USB role switch sysfs interface
chmod 600 /sys/class/usb_role/13180000.usb-role-switch/role