GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

FKIE_CVE-2026-90019

Vulnerability from fkie_nvd - Published: 2026-09-16 11:17 - Updated: 2026-09-16 11:17
Severity
Summary
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fix null pointer dereference in usb_put_function_instance() usb_put_function_instance() attempts to dereference fd inside fi struct to get mod in uvc_alloc_inst() error path. However, fd is not allocated until later in try_get_usb_function_instance() after allocating fi in uvc_alloc_inst() and thus guranteed to be null in error path. Fix this by adding a null check for fi->fd that returns if fd is null.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/0fc54a00954f9f4c3e3d4ffa64a530685d99a39b
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/3a9691fff79bcce95338435599df6d3ae433cfdc
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/5117f236e9e30744338b425395d55913c4500897
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/6e6736c049683380f5e20becde498986e9293ca4
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/6e74ac5c596fd246e37eadfc354567179ccbe9aa
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/6ea3a073ca97716d4a73df49a3bec1c3ccf8e2a0
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/7a4f4ca7ff32ae24807c83e2a06d62b13378d53c
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/d3a7fa61997db3bf6dadef4c1bd87a4fa782a817
Impacted products
Vendor Product Version
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/gadget/functions.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "0fc54a00954f9f4c3e3d4ffa64a530685d99a39b",
              "status": "affected",
              "version": "0062f6e56f70bd2230ba1ebd1667d1b32a1af3b2",
              "versionType": "git"
            },
            {
              "lessThan": "6e6736c049683380f5e20becde498986e9293ca4",
              "status": "affected",
              "version": "0062f6e56f70bd2230ba1ebd1667d1b32a1af3b2",
              "versionType": "git"
            },
            {
              "lessThan": "3a9691fff79bcce95338435599df6d3ae433cfdc",
              "status": "affected",
              "version": "0062f6e56f70bd2230ba1ebd1667d1b32a1af3b2",
              "versionType": "git"
            },
            {
              "lessThan": "7a4f4ca7ff32ae24807c83e2a06d62b13378d53c",
              "status": "affected",
              "version": "0062f6e56f70bd2230ba1ebd1667d1b32a1af3b2",
              "versionType": "git"
            },
            {
              "lessThan": "6ea3a073ca97716d4a73df49a3bec1c3ccf8e2a0",
              "status": "affected",
              "version": "0062f6e56f70bd2230ba1ebd1667d1b32a1af3b2",
              "versionType": "git"
            },
            {
              "lessThan": "d3a7fa61997db3bf6dadef4c1bd87a4fa782a817",
              "status": "affected",
              "version": "0062f6e56f70bd2230ba1ebd1667d1b32a1af3b2",
              "versionType": "git"
            },
            {
              "lessThan": "5117f236e9e30744338b425395d55913c4500897",
              "status": "affected",
              "version": "0062f6e56f70bd2230ba1ebd1667d1b32a1af3b2",
              "versionType": "git"
            },
            {
              "lessThan": "6e74ac5c596fd246e37eadfc354567179ccbe9aa",
              "status": "affected",
              "version": "0062f6e56f70bd2230ba1ebd1667d1b32a1af3b2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/gadget/functions.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.9"
            },
            {
              "lessThan": "3.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.270",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.51",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: fix null pointer dereference in usb_put_function_instance()\n\nusb_put_function_instance() attempts to dereference fd inside fi struct\nto get mod in uvc_alloc_inst() error path. However, fd is not allocated\nuntil later in try_get_usb_function_instance() after allocating fi in\nuvc_alloc_inst() and thus guranteed to be null in error path. Fix this\nby adding a null check for fi-\u003efd that returns if fd is null."
    }
  ],
  "id": "CVE-2026-90019",
  "lastModified": "2026-09-16T11:17:14.780",
  "metrics": {},
  "published": "2026-09-16T11:17:14.780",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/0fc54a00954f9f4c3e3d4ffa64a530685d99a39b"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/3a9691fff79bcce95338435599df6d3ae433cfdc"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/5117f236e9e30744338b425395d55913c4500897"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/6e6736c049683380f5e20becde498986e9293ca4"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/6e74ac5c596fd246e37eadfc354567179ccbe9aa"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/6ea3a073ca97716d4a73df49a3bec1c3ccf8e2a0"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/7a4f4ca7ff32ae24807c83e2a06d62b13378d53c"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/d3a7fa61997db3bf6dadef4c1bd87a4fa782a817"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Received"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.