CVE-2026-97482

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: goku_udc: avoid NULL deref of dev->driver in INT_USBRESET log

goku_irq() handles a number of bus events under a single ep0 path.

It already guards the gadget driver suspend/resume callbacks against a

NULL ->driver:

if (dev->gadget.speed != USB_SPEED_UNKNOWN

&& dev->driver

&& dev->driver->resume) {

spin_unlock(&dev->lock);

dev->driver->resume(&dev->gadget);

...

}

but the very next branch unconditionally dereferences dev->driver

when an INT_USBRESET arrives:

if (stat & INT_USBRESET) {

ACK(INT_USBRESET);

INFO(dev, "USB reset done, gadget %s\n",

dev->driver->driver.name);

}

If the controller raises INT_USBRESET before any gadget driver has

been bound (or after one has been unbound), dev->driver is NULL and

the printk dereferences NULL.

smatch flags the inconsistency:

drivers/usb/gadget/udc/goku_udc.c:1618 goku_irq() error:

we previously assumed 'dev->driver' could be null (se

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References