CVE-2026-31755: Linux Kernel USB CDNS3 DOS Vulnerability

CVE-2026-31755 Overview

CVE-2026-31755 is a NULL pointer dereference vulnerability in the Linux kernel's USB Cadence (cdns3) gadget driver. The flaw resides in the __cdns3_gadget_ep_queue() function, where the ep->desc pointer can be NULL when a gadget endpoint is disabled or not yet configured. Calling ep_queue on an unready endpoint dereferences this NULL pointer and triggers a kernel crash. The fix introduces a check that returns -ESHUTDOWN when ep->desc is NULL, the standard return code for unconfigured endpoints.

Critical Impact
Local triggering of an unready USB gadget endpoint causes a NULL pointer dereference in the kernel, leading to denial of service via kernel panic.

Affected Products

Linux kernel cdns3 USB gadget driver (Cadence USB3 controller support)
Linux distributions shipping affected kernel versions prior to the stable backport commits
Embedded systems and SoCs using the Cadence USB3 IP block in gadget mode

Discovery Timeline

2026-05-01 - CVE-2026-31755 published to NVD
2026-05-01 - Last updated in NVD database

Technical Details for CVE-2026-31755

Vulnerability Analysis

The vulnerability resides in the Cadence USB3 (cdns3) gadget driver, which implements USB device-mode functionality for hardware using the Cadence USB3 controller IP. When a USB function driver enqueues a request via ep_queue, the call eventually reaches __cdns3_gadget_ep_queue(). This function assumed that ep->desc, the endpoint descriptor pointer, would always be valid. In practice, the descriptor is only assigned after the endpoint has been enabled through the gadget framework.

If an endpoint is disabled or has not yet been configured by the host, ep->desc remains NULL. Any subsequent dereference of this pointer inside the queueing path produces a kernel oops, terminating the affected workload and potentially destabilizing the system. This class of bug is tracked as Null Pointer Dereference [CWE-476].

Root Cause

The root cause is a missing precondition check in the request-queueing path. The driver did not validate endpoint readiness before accessing endpoint descriptor fields. The patch adds an early return of -ESHUTDOWN when ep->desc is NULL, aligning behavior with the USB gadget API contract for unconfigured endpoints.

Attack Vector

Exploitation requires local interaction with the USB gadget stack, typically through a function driver, USB Function FS (FunctionFS), or ConfigFS gadget configuration. A local user or process able to issue requests against an unconfigured endpoint can trigger the dereference and crash the kernel, resulting in denial of service. No remote network attack vector is described in the upstream commit.

No verified public proof-of-concept code is available. The vulnerability mechanism is documented in the upstream stable commits referenced below.

Detection Methods for CVE-2026-31755

Indicators of Compromise

Kernel oops or panic messages referencing __cdns3_gadget_ep_queue or cdns3_gadget in dmesg and /var/log/kern.log
Stack traces showing NULL pointer dereference in the USB gadget queue path
Unexpected device resets or system reboots on hardware using the Cadence USB3 controller in peripheral mode

Detection Strategies

Inventory running kernel versions across endpoints and embedded devices to identify systems lacking the stable backport commits (14bf08a, 390536c, 3d1433f, 7f6f127, 9ab9b0e, d61446d, fb2ad0c)
Correlate kernel crash telemetry with USB gadget activity to identify systems triggering the dereference
Compare installed kernel package versions against distribution security advisories that incorporate the fix

Monitoring Recommendations

Centralize kernel logs and alert on oops signatures involving cdns3 symbols
Monitor for repeated USB gadget initialization failures returning -ESHUTDOWN after patching, which may indicate misbehaving function drivers
Track availability metrics for embedded systems using Cadence USB3 IP to detect crash-induced reboots

How to Mitigate CVE-2026-31755

Immediate Actions Required

Apply the upstream Linux kernel patches that add the ep->desc NULL check in __cdns3_gadget_ep_queue()
Update to a distribution kernel that incorporates one of the stable commits: 14bf08a, 390536c, 3d1433f, 7f6f127, 9ab9b0e, d61446d, or fb2ad0c
Restrict local access to USB gadget configuration interfaces (FunctionFS, ConfigFS) on affected systems until patched

Patch Information

The fix is committed across multiple stable Linux kernel branches. Each linked commit adds a check in __cdns3_gadget_ep_queue() to return -ESHUTDOWN when ep->desc is NULL, preventing the NULL pointer dereference on disabled or unconfigured endpoints. Administrators should pull the latest stable kernel for their branch from kernel.org or rely on their Linux distribution's updated kernel package.

Workarounds

Disable the cdns3 gadget driver on systems where USB device-mode functionality is not required by blacklisting the module
Limit user-space access to ConfigFS and FunctionFS gadget paths to trusted administrative accounts only
Where USB gadget mode is mandatory, ensure function drivers do not enqueue requests until endpoint enable callbacks have completed successfully

bash

# Configuration example: blacklist the cdns3 gadget driver if unused
echo "blacklist cdns3" | sudo tee /etc/modprobe.d/blacklist-cdns3.conf
sudo update-initramfs -u
# Verify module is not loaded after reboot
lsmod | grep cdns3