CVE-2026-90019 in Linux
Summary
by MITRE • 09/16/2026
In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: fix null pointer dereference in usb_put_function_instance()
usb_put_function_instance() attempts to dereference fd inside fi struct to get mod in uvc_alloc_inst() error path. However, fd is not allocated until later in try_get_usb_function_instance() after allocating fi in uvc_alloc_inst() and thus guranteed to be null in error path. Fix this by adding a null check for fi->fd that returns if fd is null.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/16/2026
The Linux kernel vulnerability identified involves a critical null pointer dereference within the USB gadget subsystem, specifically affecting the UVC (USB Video Class) function driver implementation. This flaw resides in the error handling path of the uvc_alloc_inst() function, which is responsible for allocating and initializing instances of USB video class functions. The core issue arises from an incorrect assumption regarding the initialization state of internal data structures during failure scenarios. When the allocation process encounters an error condition that triggers a cleanup routine, the system invokes usb_put_function_instance() to release resources associated with the function instance structure. However, this cleanup routine attempts to access and dereference the fd field within the fi struct without verifying whether it has been properly initialized or allocated at that specific point in execution flow.
The technical root cause lies in a race condition of initialization versus deallocation logic. In the normal successful execution path, the fd member is populated by try_get_usb_function_instance() after the initial allocation of the function instance structure fi occurs within uvc_alloc_inst(). However, if an error occurs before or during this subsequent step, the fd field remains uninitialized and effectively null. Despite this incomplete state, the error handling mechanism proceeds to call usb_put_function_instance(), which blindly attempts to dereference fi->fd to retrieve module information for reference counting purposes. This premature access results in a kernel panic due to accessing memory address zero, leading to system instability or crash depending on the specific execution context and memory layout at runtime.
From an operational impact perspective, this vulnerability allows for local denial of service attacks against systems running affected Linux kernels with USB gadget support enabled. An attacker who can trigger the specific error condition in uvc_alloc_inst() could cause a kernel oops or panic, effectively crashing the host system or disrupting critical services relying on stable kernel operation. While remote exploitation is unlikely given that this involves local device configuration and allocation logic, the severity of a kernel crash cannot be understated as it compromises availability guarantees for any service running on the affected platform. The vulnerability highlights common pitfalls in embedded systems programming where error paths are often less rigorously tested than success paths, leading to assumptions about data structure states that do not hold under failure conditions.
This flaw aligns with CWE-476, which describes a NULL Pointer Dereference vulnerability occurring when software dereferences a pointer that it expects to be valid but is actually null. In the context of MITRE ATT&CK, this relates to techniques involving exploitation of resource management errors where improper handling of object lifecycles leads to system instability. The fix implemented addresses this by introducing a defensive programming practice: adding an explicit null check for fi->fd within usb_put_function_instance(). If the fd field is found to be null, indicating that the structure was not fully initialized or allocated as expected, the function returns early without attempting further dereferences. This ensures graceful degradation and prevents kernel crashes during error recovery scenarios.
To mitigate this vulnerability in production environments, organizations should prioritize applying upstream Linux kernel patches that include this specific fix for the USB gadget subsystem. For systems unable to immediately update their kernels, administrators can consider disabling unnecessary USB gadget functionality if it is not required for current operations, thereby reducing the attack surface related to UVC function allocation. Additionally, implementing strict code review processes focused on error handling paths in C-based kernel modules can help identify similar patterns where assumptions about initialization order are made without verification. Regular vulnerability scanning and patch management cycles should explicitly check for this specific issue in distributions shipping affected kernel versions to ensure continuous protection against potential denial of service incidents stemming from these low-level memory access errors.