CVE-2026-31755

What it actually does

This is a local denial-of-service vulnerability in the Linux kernel USB Cadence USB3 gadget driver. When a gadget endpoint is disabled or not yet configured, the endpoint descriptor pointer can be NULL. If __cdns3_gadget_ep_queue() is invoked in that state, the kernel can dereference the NULL pointer and crash. The impact is availability-only: it does not directly provide code execution, privilege escalation, or data disclosure based on the published description.

Why it matters to the business

Systems that use the affected Linux kernel USB gadget functionality can be crashed by a local user or local process able to interact with the vulnerable path, causing service interruption, device reboot, downtime, or loss of availability for embedded, appliance, mobile, industrial, or USB gadget-enabled Linux deployments. The current exploitation likelihood appears low: EPSS is 0.00123, unchanged over 30 days, there is no known CISA KEV listing, no known ransomware use, and no public exploit maturity is reported.

How an attack unfolds

An attacker first needs local access with enough privileges or device interaction capability to trigger USB gadget endpoint queueing operations. They place or race a gadget endpoint into a disabled, unconfigured, or not-yet-ready state, then cause a request to be queued through the cdns3 gadget endpoint path. On vulnerable kernels, the driver assumes the endpoint descriptor exists and dereferences ep->desc even when it is NULL. This causes a kernel NULL pointer dereference, typically producing an oops, panic, watchdog reset, or system crash depending on kernel panic settings and platform behavior. Exploitation is mainly useful for disrupting availability rather than gaining control of the system.

How to fix it

Update to a Linux kernel version from the relevant distribution or vendor that includes the cdns3 gadget fix adding a NULL check for ep->desc and returning -ESHUTDOWN for unconfigured endpoints. No exact fixed package versions were provided, so use vendor advisories for the applicable distribution, appliance, Android/embedded BSP, or kernel branch. Where immediate patching is not possible, reduce exposure by disabling unused USB gadget functionality, unloading or blacklisting the cdns3 gadget driver where operationally safe, restricting local shell and device access, limiting access to configfs USB gadget configuration interfaces, and applying normal local hardening controls. Because this is a local availability issue with low observed exploitation likelihood and no KEV status, prioritize internet-facing or mission-critical appliances using USB gadget mode, embedded systems, and platforms where a reboot causes operational impact.

How to confirm the fix worked

Confirm the running kernel has the vendor fix applied by checking the installed kernel package changelog, vendor security advisory, or source tree for the change that guards against NULL ep->desc in __cdns3_gadget_ep_queue() and returns -ESHUTDOWN. Verify the active kernel version after reboot, not only the installed package version. On systems where source or symbols are available, confirm the cdns3 gadget driver contains a defensive check for an unconfigured endpoint before dereferencing ep->desc. Validate exposure by checking whether the cdns3 gadget driver is present or loaded and whether USB gadget/configfs functionality is enabled. After remediation, monitor kernel logs while exercising normal USB gadget workflows to ensure no NULL pointer dereference or cdns3 endpoint queue crash occurs.

Typical attack path

1. Obtain local access to a Linux system using the affected kernel and Cadence USB3 gadget driver functionality.
2. Identify that USB gadget mode or a cdns3 gadget endpoint is present and usable.
3. Trigger or wait for a gadget endpoint to be disabled, unconfigured, or not fully initialized.
4. Cause an endpoint queue operation to be submitted while the endpoint descriptor is NULL.
5. Trigger a kernel NULL pointer dereference in __cdns3_gadget_ep_queue().
6. Cause a kernel oops, panic, reboot, or service outage.

How to detect it

Look for evidence of kernel crashes or oops events involving the cdns3 USB gadget driver and endpoint queueing. Useful log sources include journalctl/kern.log/messages/syslog, persistent pstore or ramoops records, crash dump repositories, kdump vmcore metadata, watchdog reset logs, appliance event logs, and EDR telemetry that records kernel panic or unexpected reboot events. Search for NULL pointer dereference messages near cdns3, gadget endpoint queueing, __cdns3_gadget_ep_queue, ep_queue, or usb gadget activity. Correlate any crash with local user activity, USB gadget configuration changes, configfs writes under USB gadget paths, module load/unload events, unexpected reboots, or repeated denial-of-service patterns. Because no public exploit indicators or threat actors are reported, detection should focus on behavioral artifacts of exploitation rather than a unique exploit signature.

• __cdns3_gadget_ep_queue
• cdns3_gadget_ep_queue
• cdns3 gadget
• usb: cdns3
• NULL pointer dereference
• BUG: kernel NULL pointer dereference
• Unable to handle kernel NULL pointer dereference
• Kernel panic - not syncing
• Oops:
• ep_queue
• -ESHUTDOWN
• /sys/kernel/config/usb_gadget
• configfs-gadget
• libcomposite
• cdns3

What your security team should do

• Inventory Linux systems, appliances, embedded devices, and development boards that use USB gadget mode or the Cadence USB3 cdns3 controller driver.
• Patch affected kernels using the appropriate distribution, vendor, appliance, or BSP update as soon as operationally practical, prioritizing systems where crashes cause safety, production, or availability impact.
• If patching is delayed, disable unused USB gadget functionality or prevent loading of the cdns3 gadget driver where this does not break required functionality.
• Restrict local interactive access and administrative access to USB gadget configuration interfaces, especially configfs-based gadget setup paths.
• Add monitoring for kernel oops, panic, reboot, and cdns3 gadget crash messages to detect possible exploitation or accidental triggering.
• Because EPSS is low, unchanged, and the issue is not in KEV, treat this as a targeted availability and reliability risk rather than a broad internet-scale exploitation emergency.
• Include this CVE in kernel lifecycle tracking for embedded and appliance fleets, where kernel fixes may arrive through vendor firmware rather than standard OS package updates.