{"id":41228,"date":"2026-10-19T00:32:42","date_gmt":"2026-10-18T16:32:42","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-98756"},"modified":"2026-10-19T00:32:42","modified_gmt":"2026-10-18T16:32:42","slug":"cve-2026-98756","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-98756","title":{"rendered":"CVE-2026-98756 &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\nusb: cdns3: Fix NULL"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>usb: cdns3: Fix NULL pointer dereference in cdns3_pci_probe<\/p>\n<p>The Cadence USBSS controller is a two-function PCI device. The first<br \/>\nprobed function allocates the driver data and stores it with<br \/>\npci_set_drvdata(), while the second function reuses it via<br \/>\npci_get_drvdata() when pci_is_enabled() reports that the first<br \/>\nfunction has already been probed.<\/p>\n<p>When the second function is probed while the first one has been<br \/>\nenabled but has not yet set its driver data, pci_get_drvdata()<br \/>\nreturns NULL, and the subsequent wrap-&gt;devfn assignment dereferences<br \/>\na NULL pointer and crashes the kernel.<br \/>\nlogs:<br \/>\nCall trace:<br \/>\n  cdns3_pci_probe+0xa4\/0x300<br \/>\n  local_pci_probe+0x44\/0xa8<br \/>\n  pci_call_probe+0x54\/0x158<br \/>\n  pci_device_probe+0x84\/0x100<br \/>\n  really_probe+0x184\/0x3d0<br \/>\n  __driver_probe_device+0x80\/0x178<br \/>\n  driver_probe_device+0x44\/0xe8<br \/>\n  __driver_attach+0xec\/0x1f8<br \/>\n  bus_for_each_dev+0x7c\/0xe0<br \/>\n  driver_attach+0x28\/0x38<br \/>\n  bus_add_driver+0x110\/0x238<br \/>\n  driver_register+0x64\/0x128<br \/>\n  __pci_register_driver+0x50\/0x60<br \/>\n  cdns3_pci_driver_init+0x28\/0x38<br \/>\n  do_one_initcall+0x5c\/0x280<br \/>\n  do_initcalls+0x104\/0x1d8<br \/>\n  kernel_init_freeable+0x140\/0x218<br \/>\n  kernel_init+0x28\/0x1f8<br \/>\n  ret_from_fork+0x10\/0x20<\/p>\n<p>Return -EPROBE_DEFER in this case so that probing is retried after<br \/>\nthe first function has completed its probe.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>usb: cdns3: Fix NULL pointer dereference in cdns3_pci_probe<\/p>\n<p>The Cadence USBSS controller is a two-function PCI device. The first<br \/>\np<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-41228","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/41228","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=41228"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=41228"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=41228"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}