Unrated severityNVD Advisory· Published May 27, 2026· Updated May 27, 2026

CVE-2026-45911

Description

In the Linux kernel, the following vulnerability has been resolved:

usb: cdns3: fix role switching during resume

If the role change while we are suspended, the cdns3 driver switches to the new mode during resume. However, switching to host mode in this context causes a NULL pointer dereference.

The host role's start() operation registers a xhci-hcd device, but its probe is deferred while we are in the resume path. The host role's resume() operation assumes the xhci-hcd device is already probed, which is not the case, leading to the dereference. Since the start() operation of the new role is already called, the resume operation can be skipped.

So skip the resume operation for the new role if a role switch occurs during resume. Once the resume sequence is complete, the xhci-hcd device can be probed in case of host mode.

Unable to handle kernel NULL pointer dereference at virtual address 0000000000000208 Mem abort info: ... Data abort info: ... [0000000000000208] pgd=0000000000000000, p4d=0000000000000000 Internal error: Oops: 0000000096000004 [#1] SMP Modules linked in: CPU: 0 UID: 0 PID: 146 Comm: sh Not tainted 6.19.0-rc7-00013-g6e64f4aabfae-dirty #135 PREEMPT Hardware name: Texas Instruments J7200 EVM (DT) pstate: 20000005 (nzCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : usb_hcd_is_primary_hcd+0x0/0x1c lr : cdns_host_resume+0x24/0x5c ... Call trace: usb_hcd_is_primary_hcd+0x0/0x1c (P) cdns_resume+0x6c/0xbc cdns3_controller_resume.isra.0+0xe8/0x17c cdns3_plat_resume+0x18/0x24 platform_pm_resume+0x2c/0x68 dpm_run_callback+0x90/0x248 device_resume+0x100/0x24c dpm_resume+0x190/0x2ec dpm_resume_end+0x18/0x34 suspend_devices_and_enter+0x2b0/0xa44 pm_suspend+0x16c/0x5fc state_store+0x80/0xec kobj_attr_store+0x18/0x2c sysfs_kf_write+0x7c/0x94 kernfs_fop_write_iter+0x130/0x1dc vfs_write+0x240/0x370 ksys_write+0x70/0x108 __arm64_sys_write+0x1c/0x28 invoke_syscall+0x48/0x10c el0_svc_common.constprop.0+0x40/0xe0 do_el0_svc+0x1c/0x28 el0_svc+0x34/0x108 el0t_64_sync_handler+0xa0/0xe4 el0t_64_sync+0x198/0x19c Code: 52800003 f9407ca5 d63f00a0 17ffffe4 (f9410401) ---[ end trace 0000000000000000 ]---

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Linux kernel cdns3 USB driver NULL pointer dereference during resume with role switch, causing system crash.

Vulnerability

In the Linux kernel's cdns3 USB driver, a NULL pointer dereference occurs when a role change happens while the system is suspended and the driver switches to the new mode during resume. Specifically, switching to host mode triggers the crash because the xhci-hcd device probe is deferred during the resume path, but the host role's resume operation assumes the device is already probed. This affects kernel versions before the commit [1].

Exploitation

An attacker with control over the USB role switching mechanism (e.g., via physical access or a malicious USB-C controller) can trigger a role change while the system is suspended. No authentication is needed if the role can be influenced externally. Upon resume (e.g., from a wake event), the driver executes the host role's resume code path, leading to a NULL pointer dereference and system crash.

Impact

Successful exploitation causes a kernel NULL pointer dereference, resulting in a denial of service (system crash). The crash trace shows the failure in usb_hcd_is_primary_hcd called from cdns_host_resume, preventing the system from resuming normally.

Mitigation

The vulnerability is fixed in the Linux kernel stable commit [1]. Users should update their kernel to include this patch. The fix skips the resume operation for the new role if a role switch occurred during resume, allowing the xhci-hcd device to be probed after the resume sequence completes. No workaround is documented.

References

Making sure you're not a bot!

AI Insight generated on May 27, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

Linux/Kernelllm-fuzzy

Patches

56289298431e

usb: cdns3: fix role switching during resume

https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"Thomas Richard (TI)"Jan 30, 2026Fixed in 6.12.77via kernel-cna

commit

2 files changed · +2 −4

drivers/usb/cdns3/core.c+1 −2 modified

diff --git a/drivers/usb/cdns3/core.c b/drivers/usb/cdns3/core.c
index 1243a5cea91b52..f0e32227c0b791 100644
--- a/drivers/usb/cdns3/core.c
+++ b/drivers/usb/cdns3/core.c
@@ -551,7 +551,7 @@ int cdns_resume(struct cdns *cdns)
 		}
 	}
 
-	if (cdns->roles[cdns->role]->resume)
+	if (!role_changed && cdns->roles[cdns->role]->resume)
 		cdns->roles[cdns->role]->resume(cdns, power_lost);
 
 	return 0;
-- 
cgit 1.3-korg

drivers/usb/cdns3/core.c+1 −2 modified

diff --git a/drivers/usb/cdns3/core.c b/drivers/usb/cdns3/core.c
index 1243a5cea91b52..f0e32227c0b791 100644
--- a/drivers/usb/cdns3/core.c
+++ b/drivers/usb/cdns3/core.c
@@ -551,7 +551,7 @@ int cdns_resume(struct cdns *cdns)
 		}
 	}
 
-	if (cdns->roles[cdns->role]->resume)
+	if (!role_changed && cdns->roles[cdns->role]->resume)
 		cdns->roles[cdns->role]->resume(cdns, power_lost);
 
 	return 0;
-- 
cgit 1.3-korg

49c99dc247eb

usb: cdns3: fix role switching during resume

https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"Thomas Richard (TI)"Jan 30, 2026Fixed in 6.19.4via kernel-cna

commit

2 files changed · +2 −4

drivers/usb/cdns3/core.c+1 −2 modified

diff --git a/drivers/usb/cdns3/core.c b/drivers/usb/cdns3/core.c
index 1243a5cea91b52..f0e32227c0b791 100644
--- a/drivers/usb/cdns3/core.c
+++ b/drivers/usb/cdns3/core.c
@@ -551,7 +551,7 @@ int cdns_resume(struct cdns *cdns)
 		}
 	}
 
-	if (cdns->roles[cdns->role]->resume)
+	if (!role_changed && cdns->roles[cdns->role]->resume)
 		cdns->roles[cdns->role]->resume(cdns, power_lost);
 
 	return 0;
-- 
cgit 1.3-korg

drivers/usb/cdns3/core.c+1 −2 modified

diff --git a/drivers/usb/cdns3/core.c b/drivers/usb/cdns3/core.c
index 1243a5cea91b52..f0e32227c0b791 100644
--- a/drivers/usb/cdns3/core.c
+++ b/drivers/usb/cdns3/core.c
@@ -551,7 +551,7 @@ int cdns_resume(struct cdns *cdns)
 		}
 	}
 
-	if (cdns->roles[cdns->role]->resume)
+	if (!role_changed && cdns->roles[cdns->role]->resume)
 		cdns->roles[cdns->role]->resume(cdns, power_lost);
 
 	return 0;
-- 
cgit 1.3-korg

87e4b043b98a

usb: cdns3: fix role switching during resume

https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"Thomas Richard (TI)"Jan 30, 2026Fixed in 7.0via kernel-cna

commit

2 files changed · +2 −4

drivers/usb/cdns3/core.c+1 −2 modified

diff --git a/drivers/usb/cdns3/core.c b/drivers/usb/cdns3/core.c
index 1243a5cea91b52..f0e32227c0b791 100644
--- a/drivers/usb/cdns3/core.c
+++ b/drivers/usb/cdns3/core.c
@@ -551,7 +551,7 @@ int cdns_resume(struct cdns *cdns)
 		}
 	}
 
-	if (cdns->roles[cdns->role]->resume)
+	if (!role_changed && cdns->roles[cdns->role]->resume)
 		cdns->roles[cdns->role]->resume(cdns, power_lost);
 
 	return 0;
-- 
cgit 1.3-korg

drivers/usb/cdns3/core.c+1 −2 modified

diff --git a/drivers/usb/cdns3/core.c b/drivers/usb/cdns3/core.c
index 1243a5cea91b52..f0e32227c0b791 100644
--- a/drivers/usb/cdns3/core.c
+++ b/drivers/usb/cdns3/core.c
@@ -551,7 +551,7 @@ int cdns_resume(struct cdns *cdns)
 		}
 	}
 
-	if (cdns->roles[cdns->role]->resume)
+	if (!role_changed && cdns->roles[cdns->role]->resume)
 		cdns->roles[cdns->role]->resume(cdns, power_lost);
 
 	return 0;
-- 
cgit 1.3-korg

ff02bd303d2d

usb: cdns3: fix role switching during resume

https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"Thomas Richard (TI)"Jan 30, 2026Fixed in 5.15.203via kernel-cna

commit

2 files changed · +2 −4

drivers/usb/cdns3/core.c+1 −2 modified

diff --git a/drivers/usb/cdns3/core.c b/drivers/usb/cdns3/core.c
index 8e46fd36b0e56d..93e93bb9a314f1 100644
--- a/drivers/usb/cdns3/core.c
+++ b/drivers/usb/cdns3/core.c
@@ -550,7 +550,7 @@ int cdns_resume(struct cdns *cdns)
 		}
 	}
 
-	if (cdns->roles[cdns->role]->resume)
+	if (!role_changed && cdns->roles[cdns->role]->resume)
 		cdns->roles[cdns->role]->resume(cdns, power_lost);
 
 	return 0;
-- 
cgit 1.3-korg

drivers/usb/cdns3/core.c+1 −2 modified

diff --git a/drivers/usb/cdns3/core.c b/drivers/usb/cdns3/core.c
index 8e46fd36b0e56d..93e93bb9a314f1 100644
--- a/drivers/usb/cdns3/core.c
+++ b/drivers/usb/cdns3/core.c
@@ -550,7 +550,7 @@ int cdns_resume(struct cdns *cdns)
 		}
 	}
 
-	if (cdns->roles[cdns->role]->resume)
+	if (!role_changed && cdns->roles[cdns->role]->resume)
 		cdns->roles[cdns->role]->resume(cdns, power_lost);
 
 	return 0;
-- 
cgit 1.3-korg

94c742614899

usb: cdns3: fix role switching during resume

https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"Thomas Richard (TI)"Jan 30, 2026Fixed in 6.1.167via kernel-cna

commit

2 files changed · +2 −4

drivers/usb/cdns3/core.c+1 −2 modified

diff --git a/drivers/usb/cdns3/core.c b/drivers/usb/cdns3/core.c
index 8e46fd36b0e56d..93e93bb9a314f1 100644
--- a/drivers/usb/cdns3/core.c
+++ b/drivers/usb/cdns3/core.c
@@ -550,7 +550,7 @@ int cdns_resume(struct cdns *cdns)
 		}
 	}
 
-	if (cdns->roles[cdns->role]->resume)
+	if (!role_changed && cdns->roles[cdns->role]->resume)
 		cdns->roles[cdns->role]->resume(cdns, power_lost);
 
 	return 0;
-- 
cgit 1.3-korg

drivers/usb/cdns3/core.c+1 −2 modified

diff --git a/drivers/usb/cdns3/core.c b/drivers/usb/cdns3/core.c
index 8e46fd36b0e56d..93e93bb9a314f1 100644
--- a/drivers/usb/cdns3/core.c
+++ b/drivers/usb/cdns3/core.c
@@ -550,7 +550,7 @@ int cdns_resume(struct cdns *cdns)
 		}
 	}
 
-	if (cdns->roles[cdns->role]->resume)
+	if (!role_changed && cdns->roles[cdns->role]->resume)
 		cdns->roles[cdns->role]->resume(cdns, power_lost);
 
 	return 0;
-- 
cgit 1.3-korg

d637f6ec149f

usb: cdns3: fix role switching during resume

https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"Thomas Richard (TI)"Jan 30, 2026Fixed in 6.6.130via kernel-cna

commit

2 files changed · +2 −4

drivers/usb/cdns3/core.c+1 −2 modified

diff --git a/drivers/usb/cdns3/core.c b/drivers/usb/cdns3/core.c
index 1243a5cea91b52..f0e32227c0b791 100644
--- a/drivers/usb/cdns3/core.c
+++ b/drivers/usb/cdns3/core.c
@@ -551,7 +551,7 @@ int cdns_resume(struct cdns *cdns)
 		}
 	}
 
-	if (cdns->roles[cdns->role]->resume)
+	if (!role_changed && cdns->roles[cdns->role]->resume)
 		cdns->roles[cdns->role]->resume(cdns, power_lost);
 
 	return 0;
-- 
cgit 1.3-korg

drivers/usb/cdns3/core.c+1 −2 modified

diff --git a/drivers/usb/cdns3/core.c b/drivers/usb/cdns3/core.c
index 1243a5cea91b52..f0e32227c0b791 100644
--- a/drivers/usb/cdns3/core.c
+++ b/drivers/usb/cdns3/core.c
@@ -551,7 +551,7 @@ int cdns_resume(struct cdns *cdns)
 		}
 	}
 
-	if (cdns->roles[cdns->role]->resume)
+	if (!role_changed && cdns->roles[cdns->role]->resume)
 		cdns->roles[cdns->role]->resume(cdns, power_lost);
 
 	return 0;
-- 
cgit 1.3-korg

fc086c0ce3db

usb: cdns3: fix role switching during resume

https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"Thomas Richard (TI)"Jan 30, 2026Fixed in 6.18.14via kernel-cna

commit

2 files changed · +2 −4

drivers/usb/cdns3/core.c+1 −2 modified

diff --git a/drivers/usb/cdns3/core.c b/drivers/usb/cdns3/core.c
index 1243a5cea91b52..f0e32227c0b791 100644
--- a/drivers/usb/cdns3/core.c
+++ b/drivers/usb/cdns3/core.c
@@ -551,7 +551,7 @@ int cdns_resume(struct cdns *cdns)
 		}
 	}
 
-	if (cdns->roles[cdns->role]->resume)
+	if (!role_changed && cdns->roles[cdns->role]->resume)
 		cdns->roles[cdns->role]->resume(cdns, power_lost);
 
 	return 0;
-- 
cgit 1.3-korg

drivers/usb/cdns3/core.c+1 −2 modified

diff --git a/drivers/usb/cdns3/core.c b/drivers/usb/cdns3/core.c
index 1243a5cea91b52..f0e32227c0b791 100644
--- a/drivers/usb/cdns3/core.c
+++ b/drivers/usb/cdns3/core.c
@@ -551,7 +551,7 @@ int cdns_resume(struct cdns *cdns)
 		}
 	}
 
-	if (cdns->roles[cdns->role]->resume)
+	if (!role_changed && cdns->roles[cdns->role]->resume)
 		cdns->roles[cdns->role]->resume(cdns, power_lost);
 
 	return 0;
-- 
cgit 1.3-korg

87e4b043b98a

usb: cdns3: fix role switching during resume

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git"Thomas Richard (TI)"Jan 30, 2026via nvd-ref

commit

2 files changed · +2 −4

drivers/usb/cdns3/core.c+1 −2 modified

diff --git a/drivers/usb/cdns3/core.c b/drivers/usb/cdns3/core.c
index 1243a5cea91b52..f0e32227c0b791 100644
--- a/drivers/usb/cdns3/core.c
+++ b/drivers/usb/cdns3/core.c
@@ -551,7 +551,7 @@ int cdns_resume(struct cdns *cdns)
 		}
 	}
 
-	if (cdns->roles[cdns->role]->resume)
+	if (!role_changed && cdns->roles[cdns->role]->resume)
 		cdns->roles[cdns->role]->resume(cdns, power_lost);
 
 	return 0;
-- 
cgit 1.3-korg

drivers/usb/cdns3/core.c+1 −2 modified

diff --git a/drivers/usb/cdns3/core.c b/drivers/usb/cdns3/core.c
index 1243a5cea91b52..f0e32227c0b791 100644
--- a/drivers/usb/cdns3/core.c
+++ b/drivers/usb/cdns3/core.c
@@ -551,7 +551,7 @@ int cdns_resume(struct cdns *cdns)
 		}
 	}
 
-	if (cdns->roles[cdns->role]->resume)
+	if (!role_changed && cdns->roles[cdns->role]->resume)
 		cdns->roles[cdns->role]->resume(cdns, power_lost);
 
 	return 0;
-- 
cgit 1.3-korg

d637f6ec149f

usb: cdns3: fix role switching during resume

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git"Thomas Richard (TI)"Jan 30, 2026via nvd-ref

commit

2 files changed · +2 −4

drivers/usb/cdns3/core.c+1 −2 modified

diff --git a/drivers/usb/cdns3/core.c b/drivers/usb/cdns3/core.c
index 1243a5cea91b52..f0e32227c0b791 100644
--- a/drivers/usb/cdns3/core.c
+++ b/drivers/usb/cdns3/core.c
@@ -551,7 +551,7 @@ int cdns_resume(struct cdns *cdns)
 		}
 	}
 
-	if (cdns->roles[cdns->role]->resume)
+	if (!role_changed && cdns->roles[cdns->role]->resume)
 		cdns->roles[cdns->role]->resume(cdns, power_lost);
 
 	return 0;
-- 
cgit 1.3-korg

drivers/usb/cdns3/core.c+1 −2 modified

diff --git a/drivers/usb/cdns3/core.c b/drivers/usb/cdns3/core.c
index 1243a5cea91b52..f0e32227c0b791 100644
--- a/drivers/usb/cdns3/core.c
+++ b/drivers/usb/cdns3/core.c
@@ -551,7 +551,7 @@ int cdns_resume(struct cdns *cdns)
 		}
 	}
 
-	if (cdns->roles[cdns->role]->resume)
+	if (!role_changed && cdns->roles[cdns->role]->resume)
 		cdns->roles[cdns->role]->resume(cdns, power_lost);
 
 	return 0;
-- 
cgit 1.3-korg

ff02bd303d2d

usb: cdns3: fix role switching during resume

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git"Thomas Richard (TI)"Jan 30, 2026via nvd-ref

commit

2 files changed · +2 −4

drivers/usb/cdns3/core.c+1 −2 modified

diff --git a/drivers/usb/cdns3/core.c b/drivers/usb/cdns3/core.c
index 8e46fd36b0e56d..93e93bb9a314f1 100644
--- a/drivers/usb/cdns3/core.c
+++ b/drivers/usb/cdns3/core.c
@@ -550,7 +550,7 @@ int cdns_resume(struct cdns *cdns)
 		}
 	}
 
-	if (cdns->roles[cdns->role]->resume)
+	if (!role_changed && cdns->roles[cdns->role]->resume)
 		cdns->roles[cdns->role]->resume(cdns, power_lost);
 
 	return 0;
-- 
cgit 1.3-korg

drivers/usb/cdns3/core.c+1 −2 modified

diff --git a/drivers/usb/cdns3/core.c b/drivers/usb/cdns3/core.c
index 8e46fd36b0e56d..93e93bb9a314f1 100644
--- a/drivers/usb/cdns3/core.c
+++ b/drivers/usb/cdns3/core.c
@@ -550,7 +550,7 @@ int cdns_resume(struct cdns *cdns)
 		}
 	}
 
-	if (cdns->roles[cdns->role]->resume)
+	if (!role_changed && cdns->roles[cdns->role]->resume)
 		cdns->roles[cdns->role]->resume(cdns, power_lost);
 
 	return 0;
-- 
cgit 1.3-korg

94c742614899

usb: cdns3: fix role switching during resume

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git"Thomas Richard (TI)"Jan 30, 2026via nvd-ref

commit

2 files changed · +2 −4

drivers/usb/cdns3/core.c+1 −2 modified

diff --git a/drivers/usb/cdns3/core.c b/drivers/usb/cdns3/core.c
index 8e46fd36b0e56d..93e93bb9a314f1 100644
--- a/drivers/usb/cdns3/core.c
+++ b/drivers/usb/cdns3/core.c
@@ -550,7 +550,7 @@ int cdns_resume(struct cdns *cdns)
 		}
 	}
 
-	if (cdns->roles[cdns->role]->resume)
+	if (!role_changed && cdns->roles[cdns->role]->resume)
 		cdns->roles[cdns->role]->resume(cdns, power_lost);
 
 	return 0;
-- 
cgit 1.3-korg

drivers/usb/cdns3/core.c+1 −2 modified

diff --git a/drivers/usb/cdns3/core.c b/drivers/usb/cdns3/core.c
index 8e46fd36b0e56d..93e93bb9a314f1 100644
--- a/drivers/usb/cdns3/core.c
+++ b/drivers/usb/cdns3/core.c
@@ -550,7 +550,7 @@ int cdns_resume(struct cdns *cdns)
 		}
 	}
 
-	if (cdns->roles[cdns->role]->resume)
+	if (!role_changed && cdns->roles[cdns->role]->resume)
 		cdns->roles[cdns->role]->resume(cdns, power_lost);
 
 	return 0;
-- 
cgit 1.3-korg

49c99dc247eb

usb: cdns3: fix role switching during resume

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git"Thomas Richard (TI)"Jan 30, 2026via nvd-ref

commit

2 files changed · +2 −4

drivers/usb/cdns3/core.c+1 −2 modified

diff --git a/drivers/usb/cdns3/core.c b/drivers/usb/cdns3/core.c
index 1243a5cea91b52..f0e32227c0b791 100644
--- a/drivers/usb/cdns3/core.c
+++ b/drivers/usb/cdns3/core.c
@@ -551,7 +551,7 @@ int cdns_resume(struct cdns *cdns)
 		}
 	}
 
-	if (cdns->roles[cdns->role]->resume)
+	if (!role_changed && cdns->roles[cdns->role]->resume)
 		cdns->roles[cdns->role]->resume(cdns, power_lost);
 
 	return 0;
-- 
cgit 1.3-korg

drivers/usb/cdns3/core.c+1 −2 modified

diff --git a/drivers/usb/cdns3/core.c b/drivers/usb/cdns3/core.c
index 1243a5cea91b52..f0e32227c0b791 100644
--- a/drivers/usb/cdns3/core.c
+++ b/drivers/usb/cdns3/core.c
@@ -551,7 +551,7 @@ int cdns_resume(struct cdns *cdns)
 		}
 	}
 
-	if (cdns->roles[cdns->role]->resume)
+	if (!role_changed && cdns->roles[cdns->role]->resume)
 		cdns->roles[cdns->role]->resume(cdns, power_lost);
 
 	return 0;
-- 
cgit 1.3-korg

fc086c0ce3db

usb: cdns3: fix role switching during resume

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git"Thomas Richard (TI)"Jan 30, 2026via nvd-ref

commit

2 files changed · +2 −4

drivers/usb/cdns3/core.c+1 −2 modified

diff --git a/drivers/usb/cdns3/core.c b/drivers/usb/cdns3/core.c
index 1243a5cea91b52..f0e32227c0b791 100644
--- a/drivers/usb/cdns3/core.c
+++ b/drivers/usb/cdns3/core.c
@@ -551,7 +551,7 @@ int cdns_resume(struct cdns *cdns)
 		}
 	}
 
-	if (cdns->roles[cdns->role]->resume)
+	if (!role_changed && cdns->roles[cdns->role]->resume)
 		cdns->roles[cdns->role]->resume(cdns, power_lost);
 
 	return 0;
-- 
cgit 1.3-korg

drivers/usb/cdns3/core.c+1 −2 modified

diff --git a/drivers/usb/cdns3/core.c b/drivers/usb/cdns3/core.c
index 1243a5cea91b52..f0e32227c0b791 100644
--- a/drivers/usb/cdns3/core.c
+++ b/drivers/usb/cdns3/core.c
@@ -551,7 +551,7 @@ int cdns_resume(struct cdns *cdns)
 		}
 	}
 
-	if (cdns->roles[cdns->role]->resume)
+	if (!role_changed && cdns->roles[cdns->role]->resume)
 		cdns->roles[cdns->role]->resume(cdns, power_lost);
 
 	return 0;
-- 
cgit 1.3-korg

56289298431e

usb: cdns3: fix role switching during resume

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git"Thomas Richard (TI)"Jan 30, 2026via nvd-ref

commit

2 files changed · +2 −4

drivers/usb/cdns3/core.c+1 −2 modified

diff --git a/drivers/usb/cdns3/core.c b/drivers/usb/cdns3/core.c
index 1243a5cea91b52..f0e32227c0b791 100644
--- a/drivers/usb/cdns3/core.c
+++ b/drivers/usb/cdns3/core.c
@@ -551,7 +551,7 @@ int cdns_resume(struct cdns *cdns)
 		}
 	}
 
-	if (cdns->roles[cdns->role]->resume)
+	if (!role_changed && cdns->roles[cdns->role]->resume)
 		cdns->roles[cdns->role]->resume(cdns, power_lost);
 
 	return 0;
-- 
cgit 1.3-korg

drivers/usb/cdns3/core.c+1 −2 modified

diff --git a/drivers/usb/cdns3/core.c b/drivers/usb/cdns3/core.c
index 1243a5cea91b52..f0e32227c0b791 100644
--- a/drivers/usb/cdns3/core.c
+++ b/drivers/usb/cdns3/core.c
@@ -551,7 +551,7 @@ int cdns_resume(struct cdns *cdns)
 		}
 	}
 
-	if (cdns->roles[cdns->role]->resume)
+	if (!role_changed && cdns->roles[cdns->role]->resume)
 		cdns->roles[cdns->role]->resume(cdns, power_lost);
 
 	return 0;
-- 
cgit 1.3-korg

Vulnerability mechanics

Root cause

"Missing check for role change during resume causes the host role's resume operation to be called before the xhci-hcd device it depends on has been probed, leading to a NULL pointer dereference."

Attack vector

An attacker who can trigger a USB role switch (e.g., via physical cable attach/detach or system control) while the cdns3 controller is suspended can cause a NULL pointer dereference during resume. When the role changes to host mode while suspended, the driver calls the new role's `start()` operation, which registers an xhci-hcd device whose probe is deferred because the system is still in the resume path. The subsequent call to `cdns_host_resume()` then dereferences the not-yet-probed xhci-hcd device, crashing the kernel [patch_id=2661453].

Affected code

The vulnerability is in `drivers/usb/cdns3/core.c` in the `cdns_resume()` function. The patch shows the file path `drivers/usb/cdns3/core.c` at the line where the role's `resume` operation is conditionally called.

What the fix does

The patch adds a `!role_changed` guard to the condition that calls the new role's `resume()` operation in `cdns_resume()` [patch_id=2661453]. When a role switch occurred during suspend, the new role's `start()` has already been called, so calling `resume()` is redundant and, in the host case, dangerous because the xhci-hcd device has not yet been probed. By skipping the resume call when `role_changed` is true, the driver avoids the NULL pointer dereference and allows the xhci-hcd device to be probed normally after the resume sequence completes.

Preconditions

configThe cdns3 USB controller must be in a suspended state.
inputA USB role switch (e.g., to host mode) must occur while the controller is suspended.
networkThe system must then resume, triggering the vulnerable code path in cdns_resume().

Generated on May 27, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000