cve.bz

CVE-2026-31755

5.5 mediumEPSS 0.1%

Medium (5.5) in linux linux kernel. EPSS 0.1% chance of exploitation in the next 30 days.

In the Linux kernel, the following vulnerability has been resolved: usb: cdns3: gadget: fix NULL pointer dereference in ep_queue When the gadget endpoint is disabled or not yet configured, the ep->desc pointer can be NULL. This leads to a NULL pointer dereference when __cdns3_gadget_ep_queue() is called, causing a kernel crash. Add a check to return -ESHUTDOWN if ep->desc is NULL, which is the standard return code for unconfigured endpoints. This prevents potential crashes when ep_queue is called on endpoints that are not ready.

Severity

CVSS 3.1

5.5 medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
EPSS
0.1% chance of exploitation in the next 30 days; higher than 2% of CVEs (scores of 2026-10-31)
CWE
CWE-476
Published
Modified
Record from
the NVD, synced

Affected

References

Check your stackJSON