---
id: "CVE-2026-98756"
kind: "vulnerability"
aliases: ["CVE-2026-98756"]
title: "Linux kernel: USB Cadence cdns3 probe crashes on NULL driver data"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["cadence-usbss", "infrastructure", "linux-kernel", "pci", "usb"]
not_affected_if: ["driver-not-loaded", "no-cdns3-hardware"]
published_at: "2026-10-18T16:17:29+00:00"
first_seen_at: "2026-10-23T21:57:16+00:00"
updated_at: "2026-10-25T05:16:50+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98756", "first_seen_at": "2026-10-23T21:57:16+00:00"}]
---

# Linux kernel: USB Cadence cdns3 probe crashes on NULL driver data

In the Linux kernel's cdns3 USB controller driver, probing the second function of a two-function PCI device can dereference a NULL pointer when the first function has been enabled but has not yet stored its driver data. The result is a kernel crash during probe.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- unknown

## Fix

- Install a Linux kernel release that includes the upstream commit resolving this cdns3 probe fix (version unknown from the sources).

## Timeline

- 2026-10-23T21:57:16+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-98756

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

usb: cdns3: Fix NULL pointer dereference in cdns3_pci_probe

The Cadence USBSS controller is a two-function PCI device. The first
probed function allocates the driver data and stores it with
pci_set_drvdata(), while the second function reuses it via
pci_get_drvdata() when pci_is_enabled() reports that the first
function has already been probed.

When the second function is probed while the first one has been
enabled but has not yet set its driver data, pci_get_drvdata()
returns NULL, and the subsequent wrap->devfn assignment dereferences
a NULL pointer and crashes the kernel.
logs:
Call trace:
  cdns3_pci_probe+0xa4/0x300
  local_pci_probe+0x44/0xa8
  pci_call_probe+0x54/0x158
  pci_device_probe+0x84/0x100
  really_probe+0x184/0x3d0
  __driver_probe_device+0x80/0x178
  driver_probe_device+0x44/0xe8
  __driver_attach+0xec/0x1f8
  bus_for_each_dev+0x7c/0xe0
  driver_attach+0x28/0x38
  bus_add_driver+0x110/0x238
  driver_register+0x64/0x128
  __pci_register_driver+0x50/0x60
  cdns3_pci_driver_init+0x28/0x38
  do_one_initcall+0x5c/0x280
  do_initcalls+0x104/0x1d8
  kernel_init_freeable+0x140/0x218
  kernel_init+0x28/0x1f8
  ret_from_fork+0x10/0x20

Return -EPROBE_DEFER in this case so that probing is retried after
the first function has completed its probe.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_