CVE-2026-97482 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, Linux distribution maintainers, and users of Linux-based systems that utilize the goku_udc USB gadget driver should assess their exposure and verify if their systems are vulnerable.

Why it matters

A vulnerability in the Linux kernel's USB gadget driver, goku_udc, could lead to a NULL pointer dereference when handling INT_USBRESET events. Defenders should verify their Linux kernel versions, apply patches, and monitor updates to mitigate potential exposure.

• Verification of Linux kernel versions and patches is required to determine exposure.
• Defenders should review and apply patches to the goku_udc USB gadget driver to prevent potential NULL pointer dereferences.
• Monitoring of Linux kernel updates is necessary for future patches related to this vulnerability.

Technical summary

The goku_udc USB gadget driver in the Linux kernel has a vulnerability that can cause a NULL pointer dereference when handling INT_USBRESET events. This happens when the gadget driver is not bound or has been unbound, resulting in dev->driver being NULL. The issue is due to inconsistent handling of dev->driver in the goku_irq() function. Affected Linux kernel deployments should review and apply patches to mitigate potential exposure. The fix involves using a placeholder when the gadget driver is not bound, ensuring consistent handling of dev->driver across different branches in the goku_irq() function.

Defensive priority

Medium

Recommended defensive actions

• Review and apply the provided patches to the Linux kernel's goku_udc USB gadget driver.
• Verify that the Linux kernel version in use is not vulnerable.
• Monitor Linux kernel updates for future patches related to this vulnerability.
• Perform a thorough review of system configurations and deployments to identify potential exposure.
• Track and manage exceptions for remediated assets until evidence of successful mitigation is documented.
• Conduct regular asset inventories to ensure all affected systems are accounted for and remediated.
• Review and update monitoring and detection configurations to identify potential exploitation attempts.

Evidence notes

The vulnerability was introduced in the Linux kernel's goku_udc USB gadget driver. The issue is caused by a NULL pointer dereference when handling INT_USBRESET events without a bound gadget driver. The fix involves using a placeholder when the gadget driver is not bound.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.