CVE-2026-90019

usb: gadget: fix null pointer dereference in usb_put_function_instance()

N/A
Published: September 16, 2026 at 10:33 AM UTC
Updated: October 19, 2026 at 09:18 AM UTC
1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Severity
N/A
Exploit prediction
EPSS 0.2%

Description

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fix null pointer dereference in usb_put_function_instance() usb_put_function_instance() attempts to dereference fd inside fi struct to get mod in uvc_alloc_inst() error path. However, fd is not allocated until later in try_get_usb_function_instance() after allocating fi in uvc_alloc_inst() and thus guranteed to be null in error path. Fix this by adding a null check for fi->fd that returns if fd is null.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

0062f6e56f70bd2230ba1ebd1667d1b32a1af3b23.962f6e56f70bd2230ba1ebd1667d1b32a1af3b2
Vendor states this is fixed in 0fc54a00954f9f4c3e3d4ffa64a530685d99a39b (fixed)
Vendor states this is fixed in 3a9691fff79bcce95338435599df6d3ae433cfdc (fixed)
Vendor states this is fixed in 5117f236e9e30744338b425395d55913c4500897 (fixed)
Vendor states this is fixed in 6e6736c049683380f5e20becde498986e9293ca4 (fixed)
Vendor states this is fixed in 6e74ac5c596fd246e37eadfc354567179ccbe9aa (fixed)
Vendor states this is fixed in 6ea3a073ca97716d4a73df49a3bec1c3ccf8e2a0 (fixed)
Vendor states this is fixed in 7a4f4ca7ff32ae24807c83e2a06d62b13378d53c (fixed)
Vendor states this is fixed in d3a7fa61997db3bf6dadef4c1bd87a4fa782a817 (fixed)
Vendor states this is fixed in 3.9 (unaffected)
Vendor states this is fixed in 5.10.270 (unaffected)
Vendor states this is fixed in 5.15.221 (unaffected)
Vendor states this is fixed in 6.1.188 (unaffected)
Vendor states this is fixed in 6.12.110 (unaffected)
Vendor states this is fixed in 6.18.51 (unaffected)
Vendor states this is fixed in 6.6.157 (unaffected)
Vendor states this is fixed in 7.2.5 (unaffected)
Vendor states this is fixed in 7.3 (unaffected)
Vendor states this is fixed in 7.3-rc2 (unaffected)

Remediation

No guide yet

No remediation guidance has been written for this CVE yet, and no fixed version or vendor advisory is recorded against it.

Quick Info

StatusRECEIVED

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Free plan, no card