CVE-2026-90020 USB: gadget: fix NULL pointer dereference in gadget_dev_ioctl()
A race condition in the Linux kernel USB gadget driver allows a local attacker to trigger a NULL pointer dereference, causing a system crash.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-90020?
CVE-2026-90020 is a vulnerability in Linux, published on 16 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
USB: gadget: fix NULL pointer dereference in gadget_dev_ioctl()
gadget_dev_ioctl() reads dev->gadget before acquiring dev->lock, but dev->state is checked after acquiring the lock. Therefore a concurrent bind can change the device state between these operations, which can leave ioctl with a stale NULL gadget pointer and causing a NULL pointer dereference at gadget->ops->ioctl.
Read dev->gadget while holding dev->lock so that the gadget pointer and device state are sampled consistently.
Which versions are affected by CVE-2026-90020?
How do I fix CVE-2026-90020?
Apply the vendor's patch.
Is CVE-2026-90020 being exploited?
There is no known exploitation of CVE-2026-90020 in the wild and no public exploit code.
Sources
Also known as AZL-101394, BELL-CVE-2026-90020, DEBIAN-CVE-2026-90020, GHSA-gf8h-9qpm-2gf3, UBUNTU-CVE-2026-90020.