{"schema":"threatline.record/2","record":{"id":"CVE-2026-98756","aliases":[],"summary":"usb: cdns3: Fix NULL pointer dereference in cdns3_pci_probe","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: cdns3: Fix NULL pointer dereference in cdns3_pci_probe\n\nThe Cadence USBSS controller is a two-function PCI device. The first\nprobed function allocates the driver data and stores it with\npci_set_drvdata(), while the second function reuses it via\npci_get_drvdata() when pci_is_enabled() reports that the first\nfunction has already been probed.\n\nWhen the second function is probed while the first one has been\nenabled but has not yet set its driver data, pci_get_drvdata()\nreturns NULL, and the subsequent wrap->devfn assignment dereferences\na NULL pointer and crashes the kernel.\nlogs:\nCall trace:\n  cdns3_pci_probe+0xa4/0x300\n  local_pci_probe+0x44/0xa8\n  pci_call_probe+0x54/0x158\n  pci_device_probe+0x84/0x100\n  really_probe+0x184/0x3d0\n  __driver_probe_device+0x80/0x178\n  driver_probe_device+0x44/0xe8\n  __driver_attach+0xec/0x1f8\n  bus_for_each_dev+0x7c/0xe0\n  driver_attach+0x28/0x38\n  bus_add_driver+0x110/0x238\n  driver_register+0x64/0x128\n  __pci_register_driver+0x50/0x60\n  cdns3_pci_driver_init+0x28/0x38\n  do_one_initcall+0x5c/0x280\n  do_initcalls+0x104/0x1d8\n  kernel_init_freeable+0x140/0x218\n  kernel_init+0x28/0x1f8\n  ret_from_fork+0x10/0x20\n\nReturn -EPROBE_DEFER in this case so that probing is retried after\nthe first function has completed its probe.","categories":["Operating systems"],"product":"Linux","vendor":"Linux","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-98756","source_modified_at":"2026-10-21T12:56:32.189Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"Linux","vendor":"Linux","versions":[{"version":"7733f6c32e36ff9d7adadf40001039bf219b1cbe","lessThan":"dbdd0ca9a7eac140697a366f698a0e2bb02a06a1","status":"affected","versionType":"git"},{"version":"7733f6c32e36ff9d7adadf40001039bf219b1cbe","lessThan":"549c04df02f1bb5a10342f32e2c87f5d27c97279","status":"affected","versionType":"git"},{"version":"7733f6c32e36ff9d7adadf40001039bf219b1cbe","lessThan":"d16046f1ace2691b6a946f022fe6dc215936880b","status":"affected","versionType":"git"},{"version":"7733f6c32e36ff9d7adadf40001039bf219b1cbe","lessThan":"45b606418bae73c7cde9f0e57e5b0977c816a7c0","status":"affected","versionType":"git"},{"version":"7733f6c32e36ff9d7adadf40001039bf219b1cbe","lessThan":"e5052f2c5c73c1dcca42bafc0bc737af2b2af059","status":"affected","versionType":"git"}],"defaultStatus":"unaffected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-98756","source_modified_at":"2026-10-21T12:56:32.189Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"Linux","vendor":"Linux","versions":[{"version":"5.4","status":"affected"},{"version":"0","lessThan":"5.4","status":"unaffected","versionType":"semver"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.12.113","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.18.56","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"7.2.10","lessThanOrEqual":"7.2.*","status":"unaffected","versionType":"semver"},{"version":"7.3","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}],"defaultStatus":"affected"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-98756","source_modified_at":"2026-10-21T12:56:32.189Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"Linux","ecosystem":null},"version":"549c04df02f1bb5a10342f32e2c87f5d27c97279","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-98756","source_modified_at":"2026-10-21T12:56:32.189Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"Linux","ecosystem":null},"version":"45b606418bae73c7cde9f0e57e5b0977c816a7c0","basis":"first unaffected version stated in the CVE record"}],"cvss":null,"severity":null,"kev":{"listed":false},"epss":{"probability":0.00168,"percentile":0.05737,"score_date":"2026-10-23"},"published_at":"2026-10-18T15:47:42.085Z","modified_at":"2026-10-21T12:56:32.189Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-98756","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-10-21T12:56:32.189Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-98756","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://git.kernel.org/stable/c/dbdd0ca9a7eac140697a366f698a0e2bb02a06a1"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/549c04df02f1bb5a10342f32e2c87f5d27c97279"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/d16046f1ace2691b6a946f022fe6dc215936880b"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/45b606418bae73c7cde9f0e57e5b0977c816a7c0"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/e5052f2c5c73c1dcca42bafc0bc737af2b2af059"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"product","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-21T12:56:32.189Z","content_hash":"8215f2e84e23c9d3b2909df0380caf53d1bc65427f867ae0933f7bcd3f359465"}}