CVE-2026-97482 usb: gadget: goku_udc: avoid NULL deref of dev->driver in INT_USBRESET log
A NULL pointer dereference in the Linux kernel goku_udc driver allows local attackers to cause a denial of service via USB reset events.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-97482?
CVE-2026-97482 is a vulnerability in Linux, published on 24 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: goku_udc: avoid NULL deref of dev->driver in INT_USBRESET log
goku_irq() handles a number of bus events under a single ep0 path. It already guards the gadget driver suspend/resume callbacks against a NULL ->driver:
if (dev->gadget.speed != USB_SPEED_UNKNOWN && dev->driver && dev->driver->resume) { spin_unlock(&dev->lock); dev->driver->resume(&dev->gadget); ... }
but the very next branch unconditionally dereferences dev->driver when an INT_USBRESET arrives:
if (stat & INT_USBRESET) { ACK(INT_USBRESET); INFO(dev, "USB reset done, gadget %s\n", dev->driver->driver.name); }
If the controller raises INT_USBRESET before any gadget driver has been bound (or after one has been unbound), dev->driver is NULL and the printk dereferences NULL.
smatch flags the inconsistency:
drivers/usb/gadget/udc/goku_udc.c:1618 goku_irq() error: we previously assumed 'dev->driver' could be null (see line 1607)
Fall back to a placeholder when the gadget driver is not bound.
No functional change while a gadget driver is bound.
Which versions are affected by CVE-2026-97482?
How do I fix CVE-2026-97482?
Apply the vendor's patch.
Is CVE-2026-97482 being exploited?
There is no known exploitation of CVE-2026-97482 in the wild and no public exploit code.
Sources
Also known as AZL-103871, BELL-CVE-2026-97482, DEBIAN-CVE-2026-97482, GHSA-hc2c-96rf-cqvj, UBUNTU-CVE-2026-97482.