CVE-2026-90020
Description
In the Linux kernel, the following vulnerability has been resolved: USB: gadget: fix NULL pointer dereference in gadget_dev_ioctl() gadget_dev_ioctl() reads dev->gadget before acquiring dev->lock, but dev->state is checked after acquiring the lock. Therefore a concurrent bind can change the device state between these operations, which can leave ioctl with a stale NULL gadget pointer and causing a NULL pointer dereference at gadget->ops->ioctl. Read dev->gadget while holding dev->lock so that the gadget pointer and device state are sampled consistently.
How to fix
- Linux Linux8be30959be31b4205e3bdd2e2a6221f3a2ee7ea1, e8219accce2f6d3502ed71f5b5e854ecf27249a6, 87cbf9410b12f5c2d659bb01e8ecf6517cb9f28c, 162178ca83c3de986900385a0477eb539f8e1a7e, ebd916fdfefaacbc0e577f7037ec96b31a105e5f, c29a83c1ff3f06d5751f6d365b606c9f81ccc4cb, 64ec019bf9a8b12f53b9f2777d65aadb730b5a84, dd0eed9e165b1a6292f49e622e3dd0b7d99b106d or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 ≤ v < 8be30959be31b4205e3bdd2e2a6221f3a2ee7ea1, 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 ≤ v < e8219accce2f6d3502ed71f5b5e854ecf27249a6, 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 ≤ v < 87cbf9410b12f5c2d659bb01e8ecf6517cb9f28c, 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 ≤ v < 162178ca83c3de986900385a0477eb539f8e1a7e, 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 ≤ v < ebd916fdfefaacbc0e577f7037ec96b31a105e5f, 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 ≤ v < c29a83c1ff3f06d5751f6d365b606c9f81ccc4cb, 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 ≤ v < 64ec019bf9a8b12f53b9f2777d65aadb730b5a84, 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 ≤ v < dd0eed9e165b1a6292f49e622e3dd0b7d99b106d, 2.6.12 | 8be30959be31b4205e3bdd2e2a6221f3a2ee7ea1, e8219accce2f6d3502ed71f5b5e854ecf27249a6, 87cbf9410b12f5c2d659bb01e8ecf6517cb9f28c, 162178ca83c3de986900385a0477eb539f8e1a7e, ebd916fdfefaacbc0e577f7037ec96b31a105e5f, c29a83c1ff3f06d5751f6d365b606c9f81ccc4cb, 64ec019bf9a8b12f53b9f2777d65aadb730b5a84, dd0eed9e165b1a6292f49e622e3dd0b7d99b106d |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.