CVE-2026-45911: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-45911 Overview

CVE-2026-45911 is a NULL pointer dereference vulnerability in the Linux kernel's Cadence USB3 (cdns3) driver. The flaw occurs when a USB role change happens while the controller is suspended. During the resume sequence, the driver attempts to switch to the new role, and switching to host mode triggers a kernel NULL pointer dereference at virtual address 0x208.

The issue arises because the host role's start() operation registers an xhci-hcd device whose probe is deferred during resume. The host role's resume() operation then assumes the xhci-hcd device is already probed, leading to the crash in usb_hcd_is_primary_hcd().

Critical Impact
A local user able to trigger USB role switches across a system suspend/resume cycle can cause a kernel NULL pointer dereference, resulting in a kernel oops and denial of service.

Affected Products

Linux kernel versions containing the Cadence USB3 (cdns3) dual-role driver prior to the fix
Platforms using the Cadence USBSS-DRD controller, including Texas Instruments J7200 EVM and similar TI SoCs
Stable kernel branches receiving the backported fixes referenced in git.kernel.org commits

Discovery Timeline

2026-05-27 - CVE-2026-45911 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-45911

Vulnerability Analysis

The vulnerability resides in the cdns3 USB dual-role driver's resume path. When a USB role change is requested while the controller is in a suspended state, the driver defers the role switch until resume. During resume, the driver invokes the new role's start() operation followed by its resume() operation.

For the host role, start() calls usb_add_hcd() to register the xhci-hcd device, but the actual probe is deferred. The subsequent cdns_host_resume() invocation calls usb_hcd_is_primary_hcd() on a host controller driver structure that has not yet been initialized, dereferencing a NULL pointer.

The call chain visible in the kernel oops includes cdns3_plat_resume → cdns3_controller_resume → cdns_resume → cdns_host_resume → usb_hcd_is_primary_hcd, crashing at PC usb_hcd_is_primary_hcd+0x0/0x1c.

Root Cause

The root cause is an incorrect assumption in the host role resume handler that the xhci-hcd device is fully probed before resume() runs. When a role switch occurs during the resume sequence, the new role's start() has only deferred the probe, so the HCD pointer chain accessed by usb_hcd_is_primary_hcd() contains an uninitialized structure leading to dereference of address 0x208. This is a NULL pointer dereference [CWE-476] in kernel context.

Attack Vector

The attack vector is local. An attacker with the ability to influence USB role state and trigger system suspend/resume cycles, for example by writing to /sys/power/state, can reproduce the crash. The reproducer in the upstream report uses state_store via sysfs_kf_write, indicating a process with sufficient privileges to invoke system suspend. Successful exploitation produces a kernel oops on the affected CPU, denying service for USB and dependent subsystems and potentially destabilizing the system.

No arbitrary code execution path has been documented. The published patches across multiple stable branches resolve the condition by skipping the redundant resume() operation for the newly switched role, since its start() already established the required state. Once resume completes, the deferred xhci-hcd probe proceeds normally.

Detection Methods for CVE-2026-45911

Indicators of Compromise

Kernel oops messages referencing usb_hcd_is_primary_hcd+0x0/0x1c in the program counter and cdns_host_resume in the link register
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000208 log entries
Call traces containing cdns3_plat_resume, cdns3_controller_resume, and cdns_resume during system resume events

Detection Strategies

Monitor dmesg and /var/log/kern.log for kernel oops entries tied to the cdns3 driver around suspend/resume transitions
Correlate USB role switch events with subsequent suspend state changes in system journals to identify reproduction patterns
Track kernel version inventory against the fix commits (49c99dc, 5628929, 87e4b04, 94c7426, d637f6e, fc086c0, ff02bd3) to identify unpatched hosts

Monitoring Recommendations

Forward kernel ring buffer and journalctl -k output to a centralized logging platform and alert on Internal error: Oops strings
Add health checks that detect repeated USB subsystem failures or HCD registration errors following resume on devices using the Cadence USB3 controller
Audit embedded and IoT fleets running TI J7-class hardware for kernel build dates predating the patch references

How to Mitigate CVE-2026-45911

Immediate Actions Required

Update affected systems to a kernel build that includes one of the upstream fix commits listed in the NVD references
For embedded fleets, coordinate with the SoC vendor or board support package maintainer to backport the cdns3 resume fix
Restrict access to /sys/power/state and USB role switch sysfs entries to privileged users only on multi-tenant systems

Patch Information

The fix has been merged across multiple stable kernel branches. The corrected driver skips the resume() operation for the new role when a role switch occurs during resume, allowing the deferred xhci-hcd probe to complete normally afterward. Reference the upstream commits: Kernel Patch Commit 49c99dc, Kernel Patch Commit 5628929, Kernel Patch Commit 87e4b04, Kernel Patch Commit 94c7426, Kernel Patch Commit d637f6e, Kernel Patch Commit fc086c0, and Kernel Patch Commit ff02bd3.

Workarounds

Disable system suspend on affected hardware where USB role switching is in use until the patched kernel is deployed
Avoid initiating USB role changes while the device is in or transitioning through suspend states
Where feasible, pin the cdns3 controller to a single role (host or device) via device tree configuration to prevent dynamic role switching

bash

# Verify whether the running kernel contains the cdns3 resume fix
uname -r
zgrep -i 'cdns3\|cadence' /proc/config.gz 2>/dev/null || \
  grep -i 'cdns3\|cadence' /boot/config-$(uname -r)

# Monitor kernel log for the signature oops during suspend/resume testing
dmesg --follow | grep -E 'cdns_host_resume|usb_hcd_is_primary_hcd|NULL pointer'