kernel: usb: cdns3: Fix NULL pointer dereference in cdns3_pci_probe (CVE-2026-98756)

Overview

A flaw was found in the Linux kernel's Cadence USB3 driver. A local user could exploit this flaw to cause a Denial of Service (DoS) by crashing the system. During device discovery of a multi-function Cadence USBSS Peripheral Component Interconnect (PCI) device, the driver attempts to access shared data before the primary function has finished initializing it. This timing issue triggers a NULL pointer dereference, resulting in an unhandled kernel crash.

Vendor advisories

• Red Hat VEX · Moderate · affected: Red Hat Enterprise Linux 10 · no fix planned: Red Hat Enterprise Linux 10 · updated 2026-10-23 · vex

kernel: usb: cdns3: Fix NULL pointer dereference in cdns3_pci_probe — rated Moderate by Red Hat. Released 2026-10-18, updated 2026-10-23.

Affected:

• Red Hat Enterprise Linux 10

No fix planned:

• Red Hat Enterprise Linux 10

Not affected:

• Red Hat Enterprise Linux 6
• Red Hat Enterprise Linux 7
• Red Hat Enterprise Linux 8
• Red Hat Enterprise Linux 9
• Red Hat OpenShift Container Platform 4

Remediation

Fix deferred