CVE-2026-45911

What it actually does

This is a Linux kernel denial-of-service flaw in the Cadence USB3 cdns3 dual-role controller driver. If a USB role change occurs while the system is suspended, the driver may switch to host mode during resume and then call the host resume path before the xHCI host controller device has completed probing. That invalid state can dereference a NULL pointer, causing a kernel oops and potentially a panic or reboot. The issue is hardware and configuration dependent: it is relevant to Linux systems using the cdns3 driver with USB role switching, commonly embedded or SoC-based platforms.

Why it matters to the business

Successful exploitation can crash affected Linux systems, interrupting services, edge devices, appliances, industrial systems, or embedded products that rely on the affected USB controller. The exposure is narrower than a remote network vulnerability because exploitation requires local access or the ability to influence suspend/resume and USB role switching, and the current EPSS is low with no CISA KEV listing or known mature exploit. However, for unattended or high-availability devices, even a local crash condition can create operational outages and require manual recovery.

How an attack unfolds

An attacker first needs access to a system running an affected Linux kernel on hardware that uses the cdns3 USB dual-role controller. The attacker then causes or waits for the system to enter a suspend state and triggers a USB role change while the system is suspended, such as a transition to host mode. During resume, the cdns3 driver starts the new host role, but the xHCI host controller probe can be deferred because the system is still in the resume path. The driver then incorrectly executes the host resume operation as if the xHCI device were already available. This results in a NULL pointer dereference in the USB host controller path, producing a kernel oops and potentially crashing or rebooting the system.

How to fix it

Update to a Linux kernel version from the relevant distribution, device vendor, or upstream stable branch that includes the fix for 'usb: cdns3: fix role switching during resume'. Because no specific fixed package versions were provided, track vendor advisories for kernels that include the patched cdns3 resume behavior. Where immediate patching is not possible, reduce exposure by disabling unused cdns3 USB dual-role functionality, disabling USB role switching if operationally acceptable, disabling suspend on affected devices, restricting access to power-management interfaces such as /sys/power/state, and limiting local shell or physical access to systems that can trigger role changes. For embedded products, integrate the corrected kernel patch into the BSP or firmware image and redeploy through the normal device update process.

How to confirm the fix worked

Confirm remediation by verifying the running kernel package or firmware image includes the upstream/vendor patch that skips the new role's resume operation when a role switch occurred during resume. Check kernel version and vendor changelogs rather than relying only on uname output, because vendors may backport the fix without changing to a visibly new upstream kernel version. On systems with source access, confirm the cdns3 resume logic contains the corrected role-switch handling. In a controlled test environment, perform suspend/resume cycles with USB role changes and verify that the kernel no longer logs an oops involving cdns_host_resume, cdns_resume, cdns3_controller_resume, or usb_hcd_is_primary_hcd. Production validation should focus on patch inventory, driver presence, and absence of recurring kernel crash logs after suspend/resume events.

Typical attack path

1. Identify a Linux system using the Cadence cdns3 USB dual-role controller and an affected kernel build.
2. Obtain local access or another capability that can influence power management and USB role-switching behavior.
3. Cause the system to enter suspend or wait for a normal suspend event.
4. Trigger a USB role change while the system is suspended, especially a switch into host mode.
5. Allow or force the system to resume.
6. The kernel cdns3 resume path dereferences a NULL pointer, causing an oops, panic, reboot, or service interruption.

How to detect it

To determine whether this issue was already triggered, review kernel logs, persistent journal entries, serial console captures, crash dumps, pstore/ramoops data, and device watchdog/reset logs for oops or panic events occurring during resume from suspend and involving the cdns3 USB driver. Useful sources include dmesg output, /var/log/kern.log, /var/log/messages, journalctl -k, kdump/vmcore analysis, pstore records under /sys/fs/pstore, and embedded device serial logs. Focus on crashes with call traces containing cdns_host_resume, cdns_resume, cdns3_controller_resume, cdns3_plat_resume, platform_pm_resume, dpm_resume, suspend_devices_and_enter, state_store, sysfs_kf_write, and usb_hcd_is_primary_hcd. Also correlate with writes to /sys/power/state, suspend/resume audit events if enabled, USB role-switch activity, unexpected watchdog reboots, or repeated device resets after power-management transitions. There are no known public threat-actor-specific indicators for this CVE; detection is primarily behavioral and crash-artifact based.

• Unable to handle kernel NULL pointer dereference at virtual address 0000000000000208
• Internal error: Oops: 0000000096000004
• usb_hcd_is_primary_hcd+0x0/0x1c
• cdns_host_resume+0x24/0x5c
• cdns_resume+0x6c/0xbc
• cdns3_controller_resume
• cdns3_plat_resume
• platform_pm_resume
• dpm_resume
• dpm_resume_end
• suspend_devices_and_enter
• pm_suspend
• state_store
• sysfs_kf_write
• /sys/power/state
• Modules linked in:
• Hardware name: Texas Instruments J7200 EVM
• Code: 52800003 f9407ca5 d63f00a0 17ffffe4 (f9410401)

What your security team should do

• Prioritize patching affected embedded, edge, appliance, and high-availability Linux systems that use the cdns3 USB dual-role controller.
• Inventory systems for cdns3 driver usage and USB dual-role hardware before broad remediation, because systems without this driver or hardware are unlikely to be affected.
• If patching is delayed, restrict local users, physical access, and automation that can write to power-management interfaces or manipulate USB role switching.
• Disable suspend or USB role switching on affected systems where those features are not required.
• Monitor kernel logs and crash collectors for NULL pointer dereferences in cdns3 or USB host resume paths, especially after suspend/resume events.
• Coordinate with device vendors or BSP maintainers for backported fixes, since affected deployments may use vendor-customized kernels rather than standard distribution kernels.