CVE-2026-31754

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> usb: cdns3: gadget: fix state inconsistency on gadget init failure<br /> <br /> When cdns3_gadget_start() fails, the DRD hardware is left in gadget mode<br /> while software state remains INACTIVE, creating hardware/software state<br /> inconsistency.<br /> <br /> When switching to host mode via sysfs:<br /> echo host &gt; /sys/class/usb_role/13180000.usb-role-switch/role<br /> <br /> The role state is not set to CDNS_ROLE_STATE_ACTIVE due to the error,<br /> so cdns_role_stop() skips cleanup because state is still INACTIVE.<br /> This violates the DRD controller design specification (Figure22),<br /> which requires returning to idle state before switching roles.<br /> <br /> This leads to a synchronous external abort in xhci_gen_setup() when<br /> setting up the host controller:<br /> <br /> [ 516.440698] configfs-gadget 13180000.usb: failed to start g1: -19<br /> [ 516.442035] cdns-usb3 13180000.usb: Failed to add gadget<br /> [ 516.443278] cdns-usb3 13180000.usb: set role 2 has failed<br /> ...<br /> [ 1301.375722] xhci-hcd xhci-hcd.1.auto: xHCI Host Controller<br /> [ 1301.377716] Internal error: synchronous external abort: 96000010 [#1] PREEMPT SMP<br /> [ 1301.382485] pc : xhci_gen_setup+0xa4/0x408<br /> [ 1301.393391] backtrace:<br /> ...<br /> xhci_gen_setup+0xa4/0x408