CVE-2026-31754 usb: cdns3: gadget: fix state inconsistency on gadget init failure
A state inconsistency in the Linux kernel CDNS3 USB driver causes a system crash when switching USB roles after a failed initialization.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-31754?
CVE-2026-31754 is a medium-severity denial of service vulnerability in Linux kernel, published on 1 May 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
usb: cdns3: gadget: fix state inconsistency on gadget init failure
When cdns3_gadget_start() fails, the DRD hardware is left in gadget mode while software state remains INACTIVE, creating hardware/software state inconsistency.
When switching to host mode via sysfs: echo host > /sys/class/usb_role/13180000.usb-role-switch/role
The role state is not set to CDNS_ROLE_STATE_ACTIVE due to the error, so cdns_role_stop() skips cleanup because state is still INACTIVE. This violates the DRD controller design specification (Figure22), which requires returning to idle state before switching roles.
This leads to a synchronous external abort in xhci_gen_setup() when setting up the host controller:
[ 516.440698] configfs-gadget 13180000.usb: failed to start g1: -19 [ 516.442035] cdns-usb3 13180000.usb: Failed to add gadget [ 516.443278] cdns-usb3 13180000.usb: set role 2 has failed ... [ 1301.375722] xhci-hcd xhci-hcd.1.auto: xHCI Host Controller [ 1301.377716] Internal error: synchronous external abort: 96000010 [#1] PREEMPT SMP [ 1301.382485] pc : xhci_gen_setup+0xa4/0x408 [ 1301.393391] backtrace: ... xhci_gen_setup+0xa4/0x408 <-- CRASH xhci_plat_setup+0x44/0x58 usb_add_hcd+0x284/0x678 ... cdns_role_set+0x9c/0xbc <-- Role switch
Fix by calling cdns_drd_gadget_off() in the error path to properly clean up the DRD gadget state.
Which versions are affected by CVE-2026-31754?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-31754?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-31754 being exploited?
There is no known exploitation of CVE-2026-31754 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-31754, DEBIAN-CVE-2026-31754, GHSA-xxr8-8jrf-7gfq, ROOT-OS-DEBIAN-11-CVE-2026-31754, ROOT-OS-UBUNTU-2204-CVE-2026-31754, ROOT-OS-UBUNTU-2404-CVE-2026-31754 and 1 more.