CVE-2026-90020: Linux Kernel USB Gadget Race Condition

CVE-2026-90020 Overview

CVE-2026-90020 is a NULL pointer dereference vulnerability in the Linux kernel's USB gadget subsystem. The flaw resides in the gadget_dev_ioctl() function, where dev->gadget is read before the dev->lock mutex is acquired, while dev->state is checked after acquiring the lock. A concurrent bind operation can change the device state between these two operations, leaving the ioctl handler with a stale NULL gadget pointer. The subsequent access to gadget->ops->ioctl triggers a NULL pointer dereference in kernel context.

Critical Impact
A local attacker with access to the USB gadget device node can trigger a kernel NULL pointer dereference, resulting in a denial-of-service condition on the affected host.

Affected Products

Linux kernel — USB gadget subsystem (gadget_dev_ioctl() handler)
Multiple stable branches referenced by the upstream fix commits
Distributions shipping kernels prior to the backported patches

Discovery Timeline

2026-09-16 - CVE-2026-90020 published to NVD
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-90020

Vulnerability Analysis

The vulnerability is a race condition [CWE-362] that leads to a NULL pointer dereference [CWE-476] in the Linux kernel USB gadget driver. Two related pieces of state, dev->gadget and dev->state, are inspected under inconsistent locking. The pointer read happens outside the mutex, while the state check happens inside it. This ordering permits a concurrent bind or unbind operation to invalidate the sampled pointer before it is dereferenced.

Root Cause

The root cause is unsynchronized access to shared driver state. gadget_dev_ioctl() samples dev->gadget before taking dev->lock, but validates dev->state only after acquiring the lock. Because bind and unbind paths update both fields under the same lock, the ioctl handler can observe a state value that no longer matches the earlier gadget pointer read. The upstream fix moves the read of dev->gadget inside the critical section, so both the pointer and the state are sampled consistently.

Attack Vector

Exploitation requires local access to the USB gadget character device, typically /dev/gadget/*, which is restricted to privileged users on most distributions. An attacker races an ioctl call against a bind or unbind event on the same gadget device. When the race is won, the kernel dereferences a NULL gadget pointer at gadget->ops->ioctl, producing an oops and taking the affected subsystem, or the host, offline. No network vector is present; the impact is limited to kernel denial of service on systems that expose the gadget interface.

No public proof-of-concept code is available. See the upstream commits for the exact fix: Kernel Commit 162178ca, Kernel Commit 87cbf941, and Kernel Commit e8219acc.

Detection Methods for CVE-2026-90020

Indicators of Compromise

Kernel oops or panic messages referencing gadget_dev_ioctl in the call trace.
dmesg entries showing BUG: kernel NULL pointer dereference in USB gadget code paths.
Unexpected reboots or kdump crash artifacts on hosts that expose /dev/gadget/*.

Detection Strategies

Audit installed kernel versions against distribution advisories that reference the upstream fix commits.
Monitor kernel ring buffer output for NULL dereference traces originating in the USB gadget subsystem.
Track ioctl activity against USB gadget device nodes by non-root or containerized workloads.

Monitoring Recommendations

Forward /var/log/kern.log, journald, and kdump output to a centralized logging or SIEM tier for kernel crash correlation.
Alert on repeated kernel oops events on the same host, which can indicate an active exploitation attempt.
Inventory hosts where the USB gadget subsystem is loaded using lsmod | grep -i gadget and prioritize them for patching.

How to Mitigate CVE-2026-90020

Immediate Actions Required

Apply the vendor kernel update that includes the upstream fix for gadget_dev_ioctl() locking.
Restrict access to /dev/gadget/* device nodes to trusted administrative users only.
Unload the USB gadget modules on systems that do not require gadget functionality.

Patch Information

The upstream fix moves the read of dev->gadget inside the dev->lock critical section so the gadget pointer and device state are sampled consistently. Backports are available in multiple stable branches. Reference commits: 162178ca, 64ec019b, 87cbf941, 8be30959, c29a83c1, dd0eed9e, e8219acc, and ebd916fd. Consult your distribution's advisory for the exact package version that contains the backport.

Workarounds

Blacklist the USB gadget modules where not needed, for example with install libcomposite /bin/true in modprobe.d.
Tighten file permissions and ownership on /dev/gadget/* to prevent unprivileged access.
Use Mandatory Access Control policies (SELinux, AppArmor) to constrain processes that can invoke ioctls on gadget device nodes.

bash

# Configuration example: disable USB gadget modules until patched
echo 'install libcomposite /bin/true' | sudo tee /etc/modprobe.d/disable-usb-gadget.conf
echo 'install usb_f_fs /bin/true'    | sudo tee -a /etc/modprobe.d/disable-usb-gadget.conf
sudo rmmod usb_f_fs libcomposite 2>/dev/null || true
sudo update-initramfs -u