CVE-2026-97482

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> usb: gadget: goku_udc: avoid NULL deref of dev-&gt;driver in INT_USBRESET log<br /> <br /> goku_irq() handles a number of bus events under a single ep0 path.<br /> It already guards the gadget driver suspend/resume callbacks against a<br /> NULL -&gt;driver:<br /> <br /> if (dev-&gt;gadget.speed != USB_SPEED_UNKNOWN<br /> &amp;&amp; dev-&gt;driver<br /> &amp;&amp; dev-&gt;driver-&gt;resume) {<br /> spin_unlock(&amp;dev-&gt;lock);<br /> dev-&gt;driver-&gt;resume(&amp;dev-&gt;gadget);<br /> ...<br /> }<br /> <br /> but the very next branch unconditionally dereferences dev-&gt;driver<br /> when an INT_USBRESET arrives:<br /> <br /> if (stat &amp; INT_USBRESET) {<br /> ACK(INT_USBRESET);<br /> INFO(dev, "USB reset done, gadget %s\n",<br /> dev-&gt;driver-&gt;driver.name);<br /> }<br /> <br /> If the controller raises INT_USBRESET before any gadget driver has<br /> been bound (or after one has been unbound), dev-&gt;driver is NULL and<br /> the printk dereferences NULL.<br /> <br /> smatch flags the inconsistency:<br /> <br /> drivers/usb/gadget/udc/goku_udc.c:1618 goku_irq() error:<br /> we previously assumed &amp;#39;dev-&gt;driver&amp;#39; could be null (see line 1607)<br /> <br /> Fall back to a placeholder when the gadget driver is not bound.<br /> <br /> No functional change while a gadget driver is bound.