CVE-2026-90019
usb: gadget: fix null pointer dereference in usb_put_function_instance()
Description
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fix null pointer dereference in usb_put_function_instance() usb_put_function_instance() attempts to dereference fd inside fi struct to get mod in uvc_alloc_inst() error path. However, fd is not allocated until later in try_get_usb_function_instance() after allocating fi in uvc_alloc_inst() and thus guranteed to be null in error path. Fix this by adding a null check for fi->fd that returns if fd is null.
INFO
Published Date :
Sept. 16, 2026, 11:17 a.m.
Last Modified :
Sept. 16, 2026, 11:17 a.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Solution
- Apply the kernel patch that fixes the null pointer dereference.
- Ensure the file descriptor is checked for null before dereferencing.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-90019.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-90019 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-90019
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-90019 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-90019 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Sep. 16, 2026
Action Type Old Value New Value Added Description In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fix null pointer dereference in usb_put_function_instance() usb_put_function_instance() attempts to dereference fd inside fi struct to get mod in uvc_alloc_inst() error path. However, fd is not allocated until later in try_get_usb_function_instance() after allocating fi in uvc_alloc_inst() and thus guranteed to be null in error path. Fix this by adding a null check for fi->fd that returns if fd is null. Added Affected New affected value received. <a href="https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/90xxx/CVE-2026-90019.json">CVE-2026-90019</a> Added Reference https://git.kernel.org/stable/c/0fc54a00954f9f4c3e3d4ffa64a530685d99a39b Added Reference https://git.kernel.org/stable/c/3a9691fff79bcce95338435599df6d3ae433cfdc Added Reference https://git.kernel.org/stable/c/5117f236e9e30744338b425395d55913c4500897 Added Reference https://git.kernel.org/stable/c/6e6736c049683380f5e20becde498986e9293ca4 Added Reference https://git.kernel.org/stable/c/6e74ac5c596fd246e37eadfc354567179ccbe9aa Added Reference https://git.kernel.org/stable/c/6ea3a073ca97716d4a73df49a3bec1c3ccf8e2a0 Added Reference https://git.kernel.org/stable/c/7a4f4ca7ff32ae24807c83e2a06d62b13378d53c Added Reference https://git.kernel.org/stable/c/d3a7fa61997db3bf6dadef4c1bd87a4fa782a817