CVE-2026-31754

Vulnerability

In the Linux kernel's USB cdns3 driver, when cdns3_gadget_start() fails, the DRD (Dual Role Device) hardware remains in gadget mode while the software state is set to INACTIVE. This creates a hardware/software state inconsistency that violates the DRD controller design specification, which requires returning to an idle state before switching roles [1].

Exploitation

The inconsistency is triggered when a user attempts to switch the role to host mode via sysfs (e.g., echo host > /sys/class/usb_role/13180000.usb-role-switch/role). Because the role state is not set to CDNS_ROLE_STATE_INACTIVE due to the earlier gadget init failure, cdns_role_stop() skips cleanup, leaving the hardware in an inconsistent state. This leads to a synchronous external abort in xhci_gen_setup() during host controller setup [1].

Impact

An attacker with local access and the ability to trigger a gadget init failure (e.g., by causing -19 error) and then switch roles can cause a kernel crash (synchronous external abort), resulting in a denial of service. The crash trace shows the abort occurs in xhci_gen_setup during cdns_role_set [1].

Mitigation

The fix, committed in the Linux kernel stable tree, calls cdns_drd_gadget_off() in the error path of cdns3_gadget_start() to properly clean up the DRD gadget state and avoid the inconsistency [1]. Users should apply the latest stable kernel updates containing this commit.