PT-2026-36389 · Linux · Linux Kernel
CVE-2026-31754
·
Published
2026-04-01
·
Updated
2026-07-31
CVSS v2.0
6.0
Medium
| Vector | AV:L/AC:H/Au:S/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Linux kernel (affected versions not specified)
Description
A state inconsistency occurs in the cdns3 USB driver when
cdns3 gadget start() fails. In this scenario, the Dual-Role Device (DRD) hardware remains in gadget mode while the software state is marked as INACTIVE. If a user attempts to switch to host mode via the sysfs endpoint '/sys/class/usb role/13180000.usb-role-switch/role', the cdns role stop() function skips the necessary cleanup because the state is still INACTIVE. This violation of the DRD controller design specification can lead to a synchronous external abort in the xhci gen setup() function during host controller setup.Recommendations
Apply the fix that implements a call to the
cdns drd gadget off() function in the error path to ensure the DRD gadget state is properly cleaned up.Exploit
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux Kernel