CVE-2026-45911
Awaiting Analysis Awaiting Analysis - Queue
NULL Pointer Dereference in Linux Kernel USB cdns3 Driver

Publication date: 2026-05-27

Last updated on: 2026-05-27

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: usb: cdns3: fix role switching during resume If the role change while we are suspended, the cdns3 driver switches to the new mode during resume. However, switching to host mode in this context causes a NULL pointer dereference. The host role's start() operation registers a xhci-hcd device, but its probe is deferred while we are in the resume path. The host role's resume() operation assumes the xhci-hcd device is already probed, which is not the case, leading to the dereference. Since the start() operation of the new role is already called, the resume operation can be skipped. So skip the resume operation for the new role if a role switch occurs during resume. Once the resume sequence is complete, the xhci-hcd device can be probed in case of host mode. Unable to handle kernel NULL pointer dereference at virtual address 0000000000000208 Mem abort info: ... Data abort info: ... [0000000000000208] pgd=0000000000000000, p4d=0000000000000000 Internal error: Oops: 0000000096000004 [#1] SMP Modules linked in: CPU: 0 UID: 0 PID: 146 Comm: sh Not tainted 6.19.0-rc7-00013-g6e64f4aabfae-dirty #135 PREEMPT Hardware name: Texas Instruments J7200 EVM (DT) pstate: 20000005 (nzCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : usb_hcd_is_primary_hcd+0x0/0x1c lr : cdns_host_resume+0x24/0x5c ... Call trace: usb_hcd_is_primary_hcd+0x0/0x1c (P) cdns_resume+0x6c/0xbc cdns3_controller_resume.isra.0+0xe8/0x17c cdns3_plat_resume+0x18/0x24 platform_pm_resume+0x2c/0x68 dpm_run_callback+0x90/0x248 device_resume+0x100/0x24c dpm_resume+0x190/0x2ec dpm_resume_end+0x18/0x34 suspend_devices_and_enter+0x2b0/0xa44 pm_suspend+0x16c/0x5fc state_store+0x80/0xec kobj_attr_store+0x18/0x2c sysfs_kf_write+0x7c/0x94 kernfs_fop_write_iter+0x130/0x1dc vfs_write+0x240/0x370 ksys_write+0x70/0x108 __arm64_sys_write+0x1c/0x28 invoke_syscall+0x48/0x10c el0_svc_common.constprop.0+0x40/0xe0 do_el0_svc+0x1c/0x28 el0_svc+0x34/0x108 el0t_64_sync_handler+0xa0/0xe4 el0t_64_sync+0x198/0x19c Code: 52800003 f9407ca5 d63f00a0 17ffffe4 (f9410401) ---[ end trace 0000000000000000 ]---
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-05-27
Last Modified
2026-05-27
Generated
2026-06-16
AI Q&A
2026-05-27
EPSS Evaluated
2026-06-15
NVD
CVE-2026-45911
EUVD
EUVD-2026-32377
Affected Vendors & Products
Showing 2 associated CPEs
Vendor Product Version / Range
linux_kernel linux_kernel 6.19.0-rc7
linux_kernel cdns3 6.19.0-rc7-00013-g6e64f4aabfae
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability exists in the Linux kernel's cdns3 USB driver. It occurs when the USB role switches during the system resume process from suspension. Specifically, if the role changes to host mode during resume, the driver attempts to access a device (xhci-hcd) that has not yet been fully initialized, leading to a NULL pointer dereference and a kernel crash.

The root cause is that the host role's start operation registers the xhci-hcd device, but its probe is deferred during resume. The resume operation wrongly assumes the device is ready, causing the dereference. The fix involves skipping the resume operation for the new role if a role switch occurs during resume, allowing the device to be properly probed after the resume sequence completes.

Impact Analysis

This vulnerability can cause a kernel crash (NULL pointer dereference) during USB role switching on resume from suspension. This can lead to system instability, unexpected reboots, or denial of service as the kernel encounters a fatal error.

Systems relying on the cdns3 USB driver, especially those that switch USB roles (e.g., between host and device modes) during suspend/resume cycles, are at risk of experiencing these crashes, potentially disrupting normal operation and causing data loss or service interruptions.

Detection Guidance

This vulnerability involves a NULL pointer dereference in the cdns3 USB driver during role switching on resume in the Linux kernel. Detection would typically involve monitoring kernel logs for error messages related to this issue.

You can check your system logs (e.g., dmesg or journalctl) for kernel oops or NULL pointer dereference messages related to cdns3 or usb_hcd_is_primary_hcd.

  • Run `dmesg | grep -i 'cdns3'` to look for relevant kernel messages.
  • Run `journalctl -k | grep -i 'NULL pointer dereference'` to find kernel errors.
  • Monitor for system crashes or oops messages mentioning cdns3 or usb role switching.
Mitigation Strategies

The vulnerability is fixed by skipping the resume operation for the new role if a role switch occurs during resume, preventing the NULL pointer dereference.

Immediate mitigation steps include updating the Linux kernel to a version that contains the fix for this issue.

  • Apply the latest kernel updates or patches that address the cdns3 role switching during resume.
  • Avoid suspending and resuming USB devices that use the cdns3 driver until the fix is applied.
  • Monitor kernel logs for related errors and consider disabling USB role switching during suspend/resume if possible as a temporary workaround.
Compliance Impact

The provided information about CVE-2026-45911 does not include any details regarding its impact on compliance with common standards and regulations such as GDPR or HIPAA.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-45911. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart