CVE-2026-31755: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-31755 is a NULL pointer dereference vulnerability in the Linux kernel's USB Cadence3 (cdns3) gadget driver, specifically in the __cdns3_gadget_ep_queue() function. When a gadget endpoint is disabled or not yet configured, the ep->desc pointer can be NULL, leading to a kernel crash when ep_queue is called on that endpoint. The vulnerability was published on May 1, 2026, and affects Linux kernel versions from 5.4 through multiple stable branches up to 7.0-rc6. It carries a CVSS v3.1 base score of 5.5 (Medium), with local attack vector and high availability impact (GitHub Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-476 (NULL Pointer Dereference). In the cdns3 USB gadget driver, the __cdns3_gadget_ep_queue() function does not validate whether ep->desc is non-NULL before proceeding, which can occur when an endpoint is disabled or has not yet been configured. A local user with sufficient privileges to interact with the USB gadget subsystem can trigger this condition, causing the kernel to dereference a NULL pointer and crash. The fix adds a guard check that returns -ESHUTDOWN — the standard error code for unconfigured endpoints — when ep->desc is NULL, preventing the crash (GitHub Advisory).

Successful exploitation results in a kernel crash, causing a denial of service (DoS) on the affected system. There is no confidentiality or integrity impact — the vulnerability is limited to availability. Systems using the Cadence USB3 gadget controller (common in embedded and SoC-based platforms) are at risk of unexpected reboots or kernel panics when USB gadget endpoints are queued in an unconfigured state (GitHub Advisory, Red Hat Bugzilla).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of publication. The vulnerability requires local access with low privileges to trigger, limiting its attack surface. The EPSS score is approximately 0.024% (0.000240), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory).

Patches have been released for multiple stable kernel branches. Users should update to the following fixed versions or later: 5.15.203, 6.1.168, 6.6.134, 6.12.81, 6.18.22, 6.19.12, or 7.0 (stable). Seven separate upstream commits address this issue across the affected branches. No configuration-based workaround is documented; upgrading to a patched kernel version is the recommended remediation. Administrators should prioritize patching systems that expose USB gadget functionality, particularly embedded or SoC-based devices (GitHub Advisory, Red Hat Bugzilla).