FKIE_CVE-2026-97482

Vulnerability from fkie_nvd - Published: 2026-09-24 17:17 - Updated: 2026-09-24 17:17
Severity
Summary
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: goku_udc: avoid NULL deref of dev->driver in INT_USBRESET log goku_irq() handles a number of bus events under a single ep0 path. It already guards the gadget driver suspend/resume callbacks against a NULL ->driver: if (dev->gadget.speed != USB_SPEED_UNKNOWN && dev->driver && dev->driver->resume) { spin_unlock(&dev->lock); dev->driver->resume(&dev->gadget); ... } but the very next branch unconditionally dereferences dev->driver when an INT_USBRESET arrives: if (stat & INT_USBRESET) { ACK(INT_USBRESET); INFO(dev, "USB reset done, gadget %s\n", dev->driver->driver.name); } If the controller raises INT_USBRESET before any gadget driver has been bound (or after one has been unbound), dev->driver is NULL and the printk dereferences NULL. smatch flags the inconsistency: drivers/usb/gadget/udc/goku_udc.c:1618 goku_irq() error: we previously assumed 'dev->driver' could be null (see line 1607) Fall back to a placeholder when the gadget driver is not bound. No functional change while a gadget driver is bound.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/10d7fc3008d5b7ec03af8e08927f1d090014c2af
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/28d78783a871cdb7a637dcb72452ff7d303430ae
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/5bf5e3fba9bc7dfd69701521dbe9809f8ccbdb02
Impacted products
Vendor Product Version
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/gadget/udc/goku_udc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "10d7fc3008d5b7ec03af8e08927f1d090014c2af",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "28d78783a871cdb7a637dcb72452ff7d303430ae",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "5bf5e3fba9bc7dfd69701521dbe9809f8ccbdb02",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "6.12.111",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "6.18.53",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/gadget/udc/goku_udc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.111",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.53",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: goku_udc: avoid NULL deref of dev-\u003edriver in INT_USBRESET log\n\ngoku_irq() handles a number of bus events under a single ep0 path.\nIt already guards the gadget driver suspend/resume callbacks against a\nNULL -\u003edriver:\n\n\tif (dev-\u003egadget.speed != USB_SPEED_UNKNOWN\n\t\t\t\u0026\u0026 dev-\u003edriver\n\t\t\t\u0026\u0026 dev-\u003edriver-\u003eresume) {\n\t\tspin_unlock(\u0026dev-\u003elock);\n\t\tdev-\u003edriver-\u003eresume(\u0026dev-\u003egadget);\n\t\t...\n\t}\n\nbut the very next branch unconditionally dereferences dev-\u003edriver\nwhen an INT_USBRESET arrives:\n\n\tif (stat \u0026 INT_USBRESET) {\n\t\tACK(INT_USBRESET);\n\t\tINFO(dev, \"USB reset done, gadget %s\\n\",\n\t\t\tdev-\u003edriver-\u003edriver.name);\n\t}\n\nIf the controller raises INT_USBRESET before any gadget driver has\nbeen bound (or after one has been unbound), dev-\u003edriver is NULL and\nthe printk dereferences NULL.\n\nsmatch flags the inconsistency:\n\n  drivers/usb/gadget/udc/goku_udc.c:1618 goku_irq() error:\n  we previously assumed \u0027dev-\u003edriver\u0027 could be null (see line 1607)\n\nFall back to a placeholder when the gadget driver is not bound.\n\nNo functional change while a gadget driver is bound."
    }
  ],
  "id": "CVE-2026-97482",
  "lastModified": "2026-09-24T17:17:25.707",
  "metrics": {},
  "published": "2026-09-24T17:17:25.707",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/10d7fc3008d5b7ec03af8e08927f1d090014c2af"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/28d78783a871cdb7a637dcb72452ff7d303430ae"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/5bf5e3fba9bc7dfd69701521dbe9809f8ccbdb02"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Received"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.