Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-98756— usb: cdns3: Fix NULL pointer dereference in cdns3_pci_probe

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Linux 内核中，以下漏洞已得到修复： usb: cdns3: 修复 cdns3_pci_probe 中的空指针解引用问题 Cadence USBSS 控制器是一个双功能 PCI 设备。第一个被探测的功能会分配驱动数据，并通过 pci_set_drvdata() 将其存储；而第二个功能在 pci_is_enabled() 报告第一个功能已被探测后，会通过 pci_get_drvdata() 复用该数据。 然而，当第二个功能被探测时，若第一个功能虽已启用但尚未设置其驱动数据，pci_get_drvdata()

AI Predicted 7.8 Difficulty: Moderate

Possible ATT&CK Techniques 1 AI

T1068 · Exploitation for Privilege Escalation

Affected Version Matrix 10

VendorProduct Version RangeStatus
Linux Linux 7733f6c32e36ff9d7adadf40001039bf219b1cbe< 549c04df02f1bb5a10342f32e2c87f5d27c97279 affected
7733f6c32e36ff9d7adadf40001039bf219b1cbe< d16046f1ace2691b6a946f022fe6dc215936880b affected
7733f6c32e36ff9d7adadf40001039bf219b1cbe< 45b606418bae73c7cde9f0e57e5b0977c816a7c0 affected
7733f6c32e36ff9d7adadf40001039bf219b1cbe< e5052f2c5c73c1dcca42bafc0bc737af2b2af059 affected
5.4 affected
< 5.4 unaffected
6.12.113≤ 6.12.* unaffected
6.18.56≤ 6.18.* unaffected
… +2 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-98756

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
usb: cdns3: Fix NULL pointer dereference in cdns3_pci_probe
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: usb: cdns3: Fix NULL pointer dereference in cdns3_pci_probe The Cadence USBSS controller is a two-function PCI device. The first probed function allocates the driver data and stores it with pci_set_drvdata(), while the second function reuses it via pci_get_drvdata() when pci_is_enabled() reports that the first function has already been probed. When the second function is probed while the first one has been enabled but has not yet set its driver data, pci_get_drvdata() returns NULL, and the subsequent wrap->devfn assignment dereferences a NULL pointer and crashes the kernel. logs: Call trace: cdns3_pci_probe+0xa4/0x300 local_pci_probe+0x44/0xa8 pci_call_probe+0x54/0x158 pci_device_probe+0x84/0x100 really_probe+0x184/0x3d0 __driver_probe_device+0x80/0x178 driver_probe_device+0x44/0xe8 __driver_attach+0xec/0x1f8 bus_for_each_dev+0x7c/0xe0 driver_attach+0x28/0x38 bus_add_driver+0x110/0x238 driver_register+0x64/0x128 __pci_register_driver+0x50/0x60 cdns3_pci_driver_init+0x28/0x38 do_one_initcall+0x5c/0x280 do_initcalls+0x104/0x1d8 kernel_init_freeable+0x140/0x218 kernel_init+0x28/0x1f8 ret_from_fork+0x10/0x20 Return -EPROBE_DEFER in this case so that probing is retried after the first function has completed its probe.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 7733f6c32e36ff9d7adadf40001039bf219b1cbe ~ 549c04df02f1bb5a10342f32e2c87f5d27c97279 -
Linux Linux 5.4 -

II. Public POCs for CVE-2026-98756

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-98756

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-98756 (4)

Same Patch Batch · Linux · 2026-10-18 · 436 CVEs total

CVE-2026-98582 nfc: st21nfca: validate received frame size
CVE-2026-98568 vxlan: use one headroom snapshot for neighbour replies
CVE-2026-98570 net: ipv6: keep room for the mac header in dst_dev_overhead()
CVE-2026-98571 net: stmmac: clear stale buf->page after recycling on skb build failure
CVE-2026-98572 bpf: Fix immediate JMP JEQ/JNE on MIPS32
CVE-2026-98573 net: skbuff: fix pull-bound underflow in skb_checksum_setup_ipv6()
CVE-2026-98574 net: bcmgenet: stop Tx NAPI before disabling the queues
CVE-2026-98575 nfc: pn533: fix OOB read in pn533_acr122_is_rx_frame_valid()
CVE-2026-98576 nfc: llcp: fix slab-out-of-bounds reads when logging service names
CVE-2026-98577 nfc: llcp: fix WKS SAP hijacking via prefix match in nfc_llcp_wks_sap()
CVE-2026-98578 nfc: st21nfca: validate ISO15693 inventory length
CVE-2026-98579 nfc: llcp: fix sdreq TLV list leak on parse/alloc/send failure
CVE-2026-98580 nfc: llcp: Fix race condition in accept_queue lifecycle
CVE-2026-98581 nfc: llcp: Fix list corruption / refcount desync in nfc_llcp_recv_dm()
CVE-2026-98593 s390/debug: Fix NULL pointer dereference in debug_info_copy()
CVE-2026-98590 bpf: Fix bpf_sock context code generation
CVE-2026-98591 bpf: Fix bounds check for skb-backed dynptrs
CVE-2026-98592 net: spacemit: clear TX descriptor on fragment mapping failure
CVE-2026-98589 bpf: Reject pkt arguments in mutating subprogs
CVE-2026-98594 tg3: clean up PHYLIB resources on probe failure

Showing top 20 of 436 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-98756

No comments yet

Leave a comment