PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-45911 Linux CVE debrief

A NULL pointer dereference vulnerability exists in the Linux kernel's Cadence USB3 (cdns3) driver during system resume operations. The issue occurs when a USB role change happens while the system is suspended. Upon resume, the driver attempts to switch to host mode, but the xhci-hcd device registration is deferred during the resume path. The host role's resume() operation assumes the xhci-hcd device has already completed probing, which is not true in this scenario, leading to a NULL pointer dereference at virtual address 0x0000000000000208. The vulnerability manifests in the usb_hcd_is_primary_hcd function when called from cdns_host_resume during the resume sequence. The fix skips the resume operation for the new role when a role switch occurs during resume, allowing the xhci-hcd device to complete probing after the resume sequence finishes.

Vendor
Linux
Product
Unknown
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-06-24
Advisory published
2026-05-27
Advisory updated
2026-06-24

Who should care

Organizations running Linux systems with Cadence USB3 controllers, particularly embedded systems using Texas Instruments J7200 or similar SoCs that rely on USB role switching and suspend/resume functionality. System administrators managing Linux kernels with USB OTG or dual-role controller configurations should prioritize this fix.

Technical summary

The cdns3 driver in the Linux kernel mishandles USB role changes that occur during system suspend. When resuming, if the role changed to host mode while suspended, the driver's resume path attempts to access xhci-hcd structures before the device has completed probing, resulting in a NULL pointer dereference. The fix modifies the resume logic to skip resume operations for newly switched roles, deferring xhci-hcd initialization until after the resume sequence completes.

Defensive priority

medium

Recommended defensive actions

  • Apply kernel updates containing the fix commits when available from your Linux distribution
  • Monitor stable kernel releases for backported fixes to affected versions
  • Review systems using Cadence USB3 controllers for suspend/resume reliability
  • Consider disabling USB role switching during suspend if hardware/firmware permits
  • Test suspend/resume cycles on affected hardware after applying patches

Evidence notes

The vulnerability description and fix are sourced from the official CVE record and NVD entry. The NULL pointer dereference occurs at offset 0x208, with the crash happening in usb_hcd_is_primary_hcd when invoked from cdns_host_resume. The call trace shows the resume path through cdns_resume, cdns3_controller_resume, and platform_pm_resume. Multiple stable kernel commits are referenced, indicating backports to various kernel versions.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-45911 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-45911

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-45911 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-45911

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/49c99dc247ebf7361db9dbdade3dcebfffaf2c22

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/56289298431ed76700b9aac27a3b1d929fe61b8d

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/87e4b043b98a1d269be0b812f383881abee0ca45

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/94c742614899ff18a6b3e6f3cfbe7b9f36c865f3

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/d637f6ec149ffd2f8257bcc261561dc2e44dbb8c

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/fc086c0ce3db0eefbbeb66a5b1e626296336e33a

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/ff02bd303d2d78051771db51119d66c0cf442f47

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.