{"id":"CVE-2026-98756","state":"PUBLISHED","title":"usb: cdns3: Fix NULL pointer dereference in cdns3_pci_probe","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: cdns3: Fix NULL pointer dereference in cdns3_pci_probe\n\nThe Cadence USBSS controller is a two-function PCI device. The first\nprobed function allocates the driver data and stores it with\npci_set_drvdata(), while the second function reuses it via\npci_get_drvdata() when pci_is_enabled() reports that the first\nfunction has already been probed.\n\nWhen the second function is probed while the first one has been\nenabled but has not yet set its driver data, pci_get_drvdata()\nreturns NULL, and the subsequent wrap->devfn assignment dereferences\na NULL pointer and crashes the kernel.\nlogs:\nCall trace:\n  cdns3_pci_probe+0xa4/0x300\n  local_pci_probe+0x44/0xa8\n  pci_call_probe+0x54/0x158\n  pci_device_probe+0x84/0x100\n  really_probe+0x184/0x3d0\n  __driver_probe_device+0x80/0x178\n  driver_probe_device+0x44/0xe8\n  __driver_attach+0xec/0x1f8\n  bus_for_each_dev+0x7c/0xe0\n  driver_attach+0x28/0x38\n  bus_add_driver+0x110/0x238\n  driver_register+0x64/0x128\n  __pci_register_driver+0x50/0x60\n  cdns3_pci_driver_init+0x28/0x38\n  do_one_initcall+0x5c/0x280\n  do_initcalls+0x104/0x1d8\n  kernel_init_freeable+0x140/0x218\n  kernel_init+0x28/0x1f8\n  ret_from_fork+0x10/0x20\n\nReturn -EPROBE_DEFER in this case so that probing is retried after\nthe first function has completed its probe.","publishedAt":"2026-10-18T15:47:42.085Z","updatedAt":"2026-10-30T12:39:26.925Z","severity":null,"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"7733f6c32e36ff9d7adadf40001039bf219b1cbe","status":"affected","lessThan":"399b18b18f54495eeeda8d88e039e6af27d020c9","versionType":"git"},{"version":"7733f6c32e36ff9d7adadf40001039bf219b1cbe","status":"affected","lessThan":"88b473800ae11397e2e169aff2e17b041c040409","versionType":"git"},{"version":"7733f6c32e36ff9d7adadf40001039bf219b1cbe","status":"affected","lessThan":"fc13243658da9ed3c4c94aaff77c36a10f441b89","versionType":"git"},{"version":"7733f6c32e36ff9d7adadf40001039bf219b1cbe","status":"affected","lessThan":"dbdd0ca9a7eac140697a366f698a0e2bb02a06a1","versionType":"git"},{"version":"7733f6c32e36ff9d7adadf40001039bf219b1cbe","status":"affected","lessThan":"549c04df02f1bb5a10342f32e2c87f5d27c97279","versionType":"git"},{"version":"7733f6c32e36ff9d7adadf40001039bf219b1cbe","status":"affected","lessThan":"d16046f1ace2691b6a946f022fe6dc215936880b","versionType":"git"},{"version":"7733f6c32e36ff9d7adadf40001039bf219b1cbe","status":"affected","lessThan":"45b606418bae73c7cde9f0e57e5b0977c816a7c0","versionType":"git"},{"version":"7733f6c32e36ff9d7adadf40001039bf219b1cbe","status":"affected","lessThan":"e5052f2c5c73c1dcca42bafc0bc737af2b2af059","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/usb/cdns3/cdns3-pci-wrap.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"5.4","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.4","versionType":"semver"},{"version":"5.10.273","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.224","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.191","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.160","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.113","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.56","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.2.10","status":"unaffected","lessThanOrEqual":"7.2.*","versionType":"semver"},{"version":"7.3","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/usb/cdns3/cdns3-pci-wrap.c"]}],"references":["https://git.kernel.org/stable/c/399b18b18f54495eeeda8d88e039e6af27d020c9","https://git.kernel.org/stable/c/88b473800ae11397e2e169aff2e17b041c040409","https://git.kernel.org/stable/c/fc13243658da9ed3c4c94aaff77c36a10f441b89","https://git.kernel.org/stable/c/dbdd0ca9a7eac140697a366f698a0e2bb02a06a1","https://git.kernel.org/stable/c/549c04df02f1bb5a10342f32e2c87f5d27c97279","https://git.kernel.org/stable/c/d16046f1ace2691b6a946f022fe6dc215936880b","https://git.kernel.org/stable/c/45b606418bae73c7cde9f0e57e5b0977c816a7c0","https://git.kernel.org/stable/c/e5052f2c5c73c1dcca42bafc0bc737af2b2af059"],"weaknesses":[],"ingestedAt":"2026-10-30T12:58:04.520Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/98xxx/CVE-2026-98756.json","commit":"1f312381e38164a43607eebab851b151dd16861e","baselineCommit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-98756","state":"PUBLISHED","datePublished":"2026-10-18T15:47:42.085Z","dateUpdated":"2026-10-30T12:39:26.925Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-09-25T10:25:14.368Z"},"containers":{"cna":{"title":"usb: cdns3: Fix NULL pointer dereference in cdns3_pci_probe","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: cdns3: Fix NULL pointer dereference in cdns3_pci_probe\n\nThe Cadence USBSS controller is a two-function PCI device. The first\nprobed function allocates the driver data and stores it with\npci_set_drvdata(), while the second function reuses it via\npci_get_drvdata() when pci_is_enabled() reports that the first\nfunction has already been probed.\n\nWhen the second function is probed while the first one has been\nenabled but has not yet set its driver data, pci_get_drvdata()\nreturns NULL, and the subsequent wrap->devfn assignment dereferences\na NULL pointer and crashes the kernel.\nlogs:\nCall trace:\n  cdns3_pci_probe+0xa4/0x300\n  local_pci_probe+0x44/0xa8\n  pci_call_probe+0x54/0x158\n  pci_device_probe+0x84/0x100\n  really_probe+0x184/0x3d0\n  __driver_probe_device+0x80/0x178\n  driver_probe_device+0x44/0xe8\n  __driver_attach+0xec/0x1f8\n  bus_for_each_dev+0x7c/0xe0\n  driver_attach+0x28/0x38\n  bus_add_driver+0x110/0x238\n  driver_register+0x64/0x128\n  __pci_register_driver+0x50/0x60\n  cdns3_pci_driver_init+0x28/0x38\n  do_one_initcall+0x5c/0x280\n  do_initcalls+0x104/0x1d8\n  kernel_init_freeable+0x140/0x218\n  kernel_init+0x28/0x1f8\n  ret_from_fork+0x10/0x20\n\nReturn -EPROBE_DEFER in this case so that probing is retried after\nthe first function has completed its probe."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"7733f6c32e36ff9d7adadf40001039bf219b1cbe","status":"affected","lessThan":"399b18b18f54495eeeda8d88e039e6af27d020c9","versionType":"git"},{"version":"7733f6c32e36ff9d7adadf40001039bf219b1cbe","status":"affected","lessThan":"88b473800ae11397e2e169aff2e17b041c040409","versionType":"git"},{"version":"7733f6c32e36ff9d7adadf40001039bf219b1cbe","status":"affected","lessThan":"fc13243658da9ed3c4c94aaff77c36a10f441b89","versionType":"git"},{"version":"7733f6c32e36ff9d7adadf40001039bf219b1cbe","status":"affected","lessThan":"dbdd0ca9a7eac140697a366f698a0e2bb02a06a1","versionType":"git"},{"version":"7733f6c32e36ff9d7adadf40001039bf219b1cbe","status":"affected","lessThan":"549c04df02f1bb5a10342f32e2c87f5d27c97279","versionType":"git"},{"version":"7733f6c32e36ff9d7adadf40001039bf219b1cbe","status":"affected","lessThan":"d16046f1ace2691b6a946f022fe6dc215936880b","versionType":"git"},{"version":"7733f6c32e36ff9d7adadf40001039bf219b1cbe","status":"affected","lessThan":"45b606418bae73c7cde9f0e57e5b0977c816a7c0","versionType":"git"},{"version":"7733f6c32e36ff9d7adadf40001039bf219b1cbe","status":"affected","lessThan":"e5052f2c5c73c1dcca42bafc0bc737af2b2af059","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/usb/cdns3/cdns3-pci-wrap.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"5.4","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.4","versionType":"semver"},{"version":"5.10.273","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.224","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.191","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.160","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.113","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.56","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.2.10","status":"unaffected","lessThanOrEqual":"7.2.*","versionType":"semver"},{"version":"7.3","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/usb/cdns3/cdns3-pci-wrap.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/399b18b18f54495eeeda8d88e039e6af27d020c9"},{"url":"https://git.kernel.org/stable/c/88b473800ae11397e2e169aff2e17b041c040409"},{"url":"https://git.kernel.org/stable/c/fc13243658da9ed3c4c94aaff77c36a10f441b89"},{"url":"https://git.kernel.org/stable/c/dbdd0ca9a7eac140697a366f698a0e2bb02a06a1"},{"url":"https://git.kernel.org/stable/c/549c04df02f1bb5a10342f32e2c87f5d27c97279"},{"url":"https://git.kernel.org/stable/c/d16046f1ace2691b6a946f022fe6dc215936880b"},{"url":"https://git.kernel.org/stable/c/45b606418bae73c7cde9f0e57e5b0977c816a7c0"},{"url":"https://git.kernel.org/stable/c/e5052f2c5c73c1dcca42bafc0bc737af2b2af059"}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-10-30T12:39:26.925Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.4","versionEndExcluding":"5.10.273"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.4","versionEndExcluding":"5.15.224"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.4","versionEndExcluding":"6.1.191"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.4","versionEndExcluding":"6.6.160"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.4","versionEndExcluding":"6.12.113"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.4","versionEndExcluding":"6.18.56"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.4","versionEndExcluding":"7.2.10"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.4","versionEndExcluding":"7.3"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}}}}}