{"id":"CVE-2026-90019","revision":"db7bfab9c21a4d108492718d34798ef0","records":[{"revision":"db7bfab9c21a4d108492718d34798ef0","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-90019","aliases":[],"title":"usb: gadget: fix null pointer dereference in usb_put_function_instance()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: fix null pointer dereference in usb_put_function_instance()\n\nusb_put_function_instance() attempts to dereference fd inside fi struct\nto get mod in uvc_alloc_inst() error path. However, fd is not allocated\nuntil later in try_get_usb_function_instance() after allocating fi in\nuvc_alloc_inst() and thus guranteed to be null in error path. Fix this\nby adding a null check for fi->fd that returns if fd is null.","state":0,"publishedAt":"2026-09-16T10:33:24.173+00:00","modifiedAt":"2026-10-19T08:56:32.862+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/usb/gadget/functions.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"0062f6e56f70bd2230ba1ebd1667d1b32a1af3b2\",\n                            \"lessThan\": \"0fc54a00954f9f4c3e3d4ffa64a530685d99a39b\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"0062f6e56f70bd2230ba1ebd1667d1b32a1af3b2\",\n                            \"lessThan\": \"6e6736c049683380f5e20becde498986e9293ca4\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"0062f6e56f70bd2230ba1ebd1667d1b32a1af3b2\",\n                            \"lessThan\": \"3a9691fff79bcce95338435599df6d3ae433cfdc\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"0062f6e56f70bd2230ba1ebd1667d1b32a1af3b2\",\n                            \"lessThan\": \"7a4f4ca7ff32ae24807c83e2a06d62b13378d53c\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"0062f6e56f70bd2230ba1ebd1667d1b32a1af3b2\",\n                            \"lessThan\": \"6ea3a073ca97716d4a73df49a3bec1c3ccf8e2a0\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"0062f6e56f70bd2230ba1ebd1667d1b32a1af3b2\",\n                            \"lessThan\": \"d3a7fa61997db3bf6dadef4c1bd87a4fa782a817\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"0062f6e56f70bd2230ba1ebd1667d1b32a1af3b2\",\n                            \"lessThan\": \"5117f236e9e30744338b425395d55913c4500897\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"0062f6e56f70bd2230ba1ebd1667d1b32a1af3b2\",\n                            \"lessThan\": \"6e74ac5c596fd246e37eadfc354567179ccbe9aa\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/usb/gadget/functions.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"3.9\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"3.9\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.10.270\",\n                            \"lessThanOrEqual\": \"5.10.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.221\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.188\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.157\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.110\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.51\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.5\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/0fc54a00954f9f4c3e3d4ffa64a530685d99a39b","https://git.kernel.org/stable/c/6e6736c049683380f5e20becde498986e9293ca4","https://git.kernel.org/stable/c/3a9691fff79bcce95338435599df6d3ae433cfdc","https://git.kernel.org/stable/c/7a4f4ca7ff32ae24807c83e2a06d62b13378d53c","https://git.kernel.org/stable/c/6ea3a073ca97716d4a73df49a3bec1c3ccf8e2a0","https://git.kernel.org/stable/c/d3a7fa61997db3bf6dadef4c1bd87a4fa782a817","https://git.kernel.org/stable/c/5117f236e9e30744338b425395d55913c4500897","https://git.kernel.org/stable/c/6e74ac5c596fd246e37eadfc354567179ccbe9aa"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-90019","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-90019","identifiers":["CVE-2026-90019"]},"retained":false,"historicalAffected":[]}],"coverage":[]}