CVE-2026-31754

medium

In the Linux kernel, the following vulnerability has been resolved: usb: cdns3: gadget: fix state inconsistency on gadget init failure When cdns3_gadget_star…

Vendor / product: Linux — linux kernel

In the Linux kernel, the following vulnerability has been resolved: usb: cdns3: gadget: fix state inconsistency on gadget init failure When cdns3_gadget_start() fails, the DRD hardware is left in gadget mode while software state remains INACTIVE, creating hardware/software state inconsistency. When switching to host mode via sysfs: echo host > /sys/class/usb_role/13180000.usb-role-switch/role The role state is not set to CDNS_ROLE_STATE_ACTIVE due to the error, so cdns_role_stop() skips cleanup because state is still INACTIVE. This violates the DRD controller design specification (Figure22), which requires returning to idle state before switching roles. This leads to a synchronous external abort in xhci_gen_setup() when setting up the host controller: [ 516.440698] configfs-gadget 13180000.usb: failed to start g1: -19 [ 516.442035] cdns-usb3 13180000.usb: Failed to add gadget [ 516.443278] cdns-usb3 13180000.usb: set role 2 has failed ... [ 1301.375722] xhci-hcd xhci-hcd.1.auto: xHCI Host Controller [ 1301.377716] Internal error: synchronous external abort: 96000010 [#1] PREEMPT SMP [ 1301.382485] pc : xhci_gen_setup+0xa4/0x408 [ 1301.393391] backtrace: ... xhci_gen_setup+0xa4/0x408

CVSS

5.5

5.5 (CVSS v3.1)

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Severity source: NVD CVSS v3.1 (nvd@nist.gov)

Timeline (UTC)

Published: 2026-05-01 15:16

Modified: 2026-11-11 21:10

NVD status: Analyzed

Last synced 5 hours ago

Verified against the source API 2026-11-11 21:11 UTC

Exploitation

Not listed in CISA KEV (as of last catalog sync)

Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).

Affected products

linux / linux_kernel ≥5.4 <5.15.203, ≥5.16 <6.1.168, ≥6.2 <6.6.134, ≥6.7 <6.12.81, ≥6.13 <6.18.22, ≥6.19 <6.19.12

Weakness classification (CWE)

NVD-CWE-noinfo

Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.

Mitigation & advisories

Patch / mitigation: https://git.kernel.org/stable/c/5a85599ca4d2584d89dc69f4fc49303b75a42338

Patch / mitigation: https://git.kernel.org/stable/c/9b1d301fbae837bf6979a19030b81d869bb15f7a

Patch / mitigation: https://git.kernel.org/stable/c/b490f0e477d26d29ed51e5dc47e3b9bd31bcb49f

Patch / mitigation: https://git.kernel.org/stable/c/c32f8748d70c8fc77676ad92ed76cede17bf2c48

Patch / mitigation: https://git.kernel.org/stable/c/c7e475ae3a5593c5db21b3b7dca4ba8bdac9b47f

Patch / mitigation: https://git.kernel.org/stable/c/cfca84f5986afceb63a3adf39d4a98e915aebbc2

Patch / mitigation: https://git.kernel.org/stable/c/fb7110a052467098967284ef14d306810b354937

References

https://git.kernel.org/stable/c/5a85599ca4d2584d89dc69f4fc49303b75a42338 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/9b1d301fbae837bf6979a19030b81d869bb15f7a 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/b490f0e477d26d29ed51e5dc47e3b9bd31bcb49f 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/c32f8748d70c8fc77676ad92ed76cede17bf2c48 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/c7e475ae3a5593c5db21b3b7dca4ba8bdac9b47f 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/cfca84f5986afceb63a3adf39d4a98e915aebbc2 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/fb7110a052467098967284ef14d306810b354937 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Data sources

NVD CVE API 2.0 — fetched 2026-11-11 21:11 UTC · record ↗

Learn the basics

Understanding CVEs and CVSS Scores

CVE-2026-31754

Affected products

Weakness classification (CWE)

Mitigation & advisories

References

Data sources

Learn the basics

Related CVEs