PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-45911 Linux CVE debrief

A NULL pointer dereference vulnerability exists in the Linux kernel's Cadence USB3 (cdns3) driver during system resume operations. The issue occurs when a USB role change happens while the system is suspended. Upon resume, the driver attempts to switch to host mode, but the xhci-hcd device registration is deferred during the resume path. The host role's resume() operation assumes the xhci-hcd device has already completed probing, which is not true in this scenario, leading to a NULL pointer dereference at virtual address 0x0000000000000208. The vulnerability manifests in the usb_hcd_is_primary_hcd function when called from cdns_host_resume during the resume sequence. The fix skips the resume operation for the new role when a role switch occurs during resume, allowing the xhci-hcd device to complete probing after the resume sequence finishes.

Vendor
Linux
Product
Unknown
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-05-27
Advisory published
2026-05-27
Advisory updated
2026-05-27

Who should care

Organizations running Linux systems with Cadence USB3 controllers, particularly embedded systems using Texas Instruments J7200 or similar SoCs that rely on USB role switching and suspend/resume functionality. System administrators managing Linux kernels with USB OTG or dual-role controller configurations should prioritize this fix.

Technical summary

The cdns3 driver in the Linux kernel mishandles USB role changes that occur during system suspend. When resuming, if the role changed to host mode while suspended, the driver's resume path attempts to access xhci-hcd structures before the device has completed probing, resulting in a NULL pointer dereference. The fix modifies the resume logic to skip resume operations for newly switched roles, deferring xhci-hcd initialization until after the resume sequence completes.

Defensive priority

medium

Recommended defensive actions

  • Apply kernel updates containing the fix commits when available from your Linux distribution
  • Monitor stable kernel releases for backported fixes to affected versions
  • Review systems using Cadence USB3 controllers for suspend/resume reliability
  • Consider disabling USB role switching during suspend if hardware/firmware permits
  • Test suspend/resume cycles on affected hardware after applying patches

Evidence notes

The vulnerability description and fix are sourced from the official CVE record and NVD entry. The NULL pointer dereference occurs at offset 0x208, with the crash happening in usb_hcd_is_primary_hcd when invoked from cdns_host_resume. The call trace shows the resume path through cdns_resume, cdns3_controller_resume, and platform_pm_resume. Multiple stable kernel commits are referenced, indicating backports to various kernel versions.

Official resources

2026-05-27