NULL Pointer Dereference Vulnerability in Linux Kernel USB Gadget

CVE-2026-90020

What is CVE-2026-90020?

A vulnerability in the Linux kernel's USB gadget subsystem allows for a NULL pointer dereference, which occurs when the function gadget_dev_ioctl() checks the device state without appropriate locking. This can lead to inconsistencies, where a concurrent bind may alter the device state, leaving the ioctl function susceptible to accessing a stale NULL gadget pointer. The fix ensures that the device's gadget pointer is securely accessed while the device lock is held, mitigating the risk of the error.

References