CVE-2026-31754

A flaw was found in the Linux kernel's USB subsystem, specifically within the cdns3 gadget driver. A local user could exploit this vulnerability by attempting to switch the USB role to host mode after a gadget initialization failure. This state inconsistency can lead to a system crash, resulting in a Denial of Service (DoS).

Cadence USB3 gadget init failure left inconsistent controller state; upstream unwinds safely. Red Hat recommends patched kernels for embedded gadget users; gadget drivers are rarely disabled via simple module policy alone.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.