CVE-2026-90019: Linux Kernel USB Gadget Use-After-Free

CVE-2026-90019 Overview

CVE-2026-90019 is a null pointer dereference vulnerability in the Linux kernel's USB gadget subsystem. The flaw resides in usb_put_function_instance(), which attempts to dereference the fd member of the fi struct to obtain the mod reference during the uvc_alloc_inst() error path. Because fd is only allocated later in try_get_usb_function_instance() after fi is allocated in uvc_alloc_inst(), the pointer is guaranteed to be null when the error path executes. Triggering the error path results in a kernel-mode null pointer dereference and denial of service.

Critical Impact
Local triggering of the USB gadget UVC allocation error path causes a kernel null pointer dereference, leading to a kernel oops or system crash.

Affected Products

Linux kernel — USB gadget subsystem (drivers/usb/gadget/) UVC function
Stable kernel branches referenced by the fix commits 0fc54a0, 3a9691f, 5117f23, 6e6736c, 6e74ac5, 6ea3a07, 7a4f4ca, and d3a7fa6
Distributions shipping unpatched kernels that enable CONFIG_USB_CONFIGFS with the UVC gadget function

Discovery Timeline

2026-09-16 - CVE-2026-90019 published to the National Vulnerability Database
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-90019

Vulnerability Analysis

The vulnerability affects the USB gadget framework used to expose USB peripheral functions from Linux systems. When uvc_alloc_inst() allocates a function instance (fi) for the USB Video Class (UVC) gadget and subsequently fails, the error path calls usb_put_function_instance(). That helper dereferences fi->fd to obtain the owning module pointer for reference counting.

At the point of the failure, fi->fd has not yet been populated. Field initialization of fd happens later inside try_get_usb_function_instance(), after uvc_alloc_inst() returns. Dereferencing the null pointer produces a kernel-mode fault. The fix adds an explicit null check on fi->fd in usb_put_function_instance() and returns early when the pointer is null, avoiding the invalid memory access.

Root Cause

The root cause is an ordering mismatch between allocation and cleanup. The cleanup helper assumes fi->fd is always valid, but the allocation sequence populates fi before fd. Any early failure in uvc_alloc_inst() therefore reaches cleanup code operating on partially initialized state, classifying this as a null pointer dereference [CWE-476].

Attack Vector

Exploitation requires the ability to trigger the UVC gadget allocation error path. On systems that expose USB gadget configuration through configfs, this typically requires local access with privileges to write to /sys/kernel/config/usb_gadget/. A local user or process capable of instantiating the UVC function under adverse allocation conditions can drive the kernel into the vulnerable cleanup path, producing a null pointer dereference and a kernel oops. There is no public evidence of remote exploitation, and no known exploit is available.

See the upstream fixes for exact patch content, including the primary fix commit 7a4f4ca and the backports 0fc54a0, 3a9691f, 5117f23, 6e6736c, 6e74ac5, 6ea3a07, and d3a7fa6.

Detection Methods for CVE-2026-90019

Indicators of Compromise

Kernel oops messages referencing usb_put_function_instance or uvc_alloc_inst in dmesg or /var/log/kern.log.
Unexpected process crashes or system instability following interaction with /sys/kernel/config/usb_gadget/ UVC entries.
Repeated failed attempts to instantiate a UVC gadget function under low-memory or fault-injection conditions.

Detection Strategies

Inventory running kernel versions and compare against the fixed stable branches identified by the referenced commit hashes.
Audit systems for the presence of the USB gadget UVC function module (usb_f_uvc) and confirm whether configfs-based gadget management is enabled.
Correlate kernel crash telemetry with users or workloads that manipulate USB gadget configuration.

Monitoring Recommendations

Forward kernel logs to a centralized logging or SIEM platform and alert on NULL pointer dereference faults referencing USB gadget symbols.
Monitor writes to /sys/kernel/config/usb_gadget/ and loads of the usb_f_uvc module on production systems.
Track kernel package versions across the fleet and flag hosts that have not received the stable update containing the fix.

How to Mitigate CVE-2026-90019

Immediate Actions Required

Apply the latest stable Linux kernel update from your distribution vendor that includes the referenced fix commits.
On systems that do not need USB gadget functionality, unload or blacklist the usb_f_uvc and related gadget modules.
Restrict local access to configfs mount points, ensuring only trusted administrators can create USB gadget functions.

Patch Information

The upstream fix adds a null check on fi->fd inside usb_put_function_instance() and returns early when the pointer is null, preventing dereference during the uvc_alloc_inst() error path. The change is present in the mainline commit 7a4f4ca and backported through multiple stable branches. Rebuild or update to a kernel that includes one of the listed commits, then reboot to load the patched image.

Workarounds

Disable the USB gadget UVC function on systems that do not require USB video peripheral emulation.
Unmount or restrict permissions on configfs to prevent unprivileged construction of gadget functions.
Limit local shell access on affected devices until the patched kernel is deployed.

bash

# Configuration example: blacklist the UVC gadget function module
echo "blacklist usb_f_uvc" | sudo tee /etc/modprobe.d/blacklist-usb-f-uvc.conf
sudo depmod -a
sudo update-initramfs -u   # Debian/Ubuntu
# sudo dracut -f          # RHEL/Fedora/SUSE