{"id":"CVE-2026-98756","aliases":[],"cve":{"records":[{"id":"CVE-2026-98756","source":"Linux","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-09-25T10:25:14.368Z","published":"2026-10-18T15:47:42.085Z","modified":"2026-10-30T12:39:26.925Z"}],"publishers":[{"name":"Linux","role":"CNA","organizationId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","modified":"2026-10-30T12:39:26.925Z"}],"references":[{"url":"https://git.kernel.org/stable/c/399b18b18f54495eeeda8d88e039e6af27d020c9","tags":[],"source":"Linux"},{"url":"https://git.kernel.org/stable/c/88b473800ae11397e2e169aff2e17b041c040409","tags":[],"source":"Linux"},{"url":"https://git.kernel.org/stable/c/fc13243658da9ed3c4c94aaff77c36a10f441b89","tags":[],"source":"Linux"},{"url":"https://git.kernel.org/stable/c/dbdd0ca9a7eac140697a366f698a0e2bb02a06a1","tags":[],"source":"Linux"},{"url":"https://git.kernel.org/stable/c/549c04df02f1bb5a10342f32e2c87f5d27c97279","tags":[],"source":"Linux"},{"url":"https://git.kernel.org/stable/c/d16046f1ace2691b6a946f022fe6dc215936880b","tags":[],"source":"Linux"},{"url":"https://git.kernel.org/stable/c/45b606418bae73c7cde9f0e57e5b0977c816a7c0","tags":[],"source":"Linux"},{"url":"https://git.kernel.org/stable/c/e5052f2c5c73c1dcca42bafc0bc737af2b2af059","tags":[],"source":"Linux"}],"weaknesses":[],"applicability":[{"source":"Linux","statements":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.4","versionEndExcluding":"5.10.273"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.4","versionEndExcluding":"5.15.224"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.4","versionEndExcluding":"6.1.191"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.4","versionEndExcluding":"6.6.160"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.4","versionEndExcluding":"6.12.113"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.4","versionEndExcluding":"6.18.56"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.4","versionEndExcluding":"7.2.10"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.4","versionEndExcluding":"7.3"}]}]}]}],"prioritization":[]},"title":"usb: cdns3: Fix NULL pointer dereference in cdns3_pci_probe","titleSource":"Linux","descriptionSource":"Linux","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: cdns3: Fix NULL pointer dereference in cdns3_pci_probe\n\nThe Cadence USBSS controller is a two-function PCI device. The first\nprobed function allocates the driver data and stores it with\npci_set_drvdata(), while the second function reuses it via\npci_get_drvdata() when pci_is_enabled() reports that the first\nfunction has already been probed.\n\nWhen the second function is probed while the first one has been\nenabled but has not yet set its driver data, pci_get_drvdata()\nreturns NULL, and the subsequent wrap->devfn assignment dereferences\na NULL pointer and crashes the kernel.\nlogs:\nCall trace:\n  cdns3_pci_probe+0xa4/0x300\n  local_pci_probe+0x44/0xa8\n  pci_call_probe+0x54/0x158\n  pci_device_probe+0x84/0x100\n  really_probe+0x184/0x3d0\n  __driver_probe_device+0x80/0x178\n  driver_probe_device+0x44/0xe8\n  __driver_attach+0xec/0x1f8\n  bus_for_each_dev+0x7c/0xe0\n  driver_attach+0x28/0x38\n  bus_add_driver+0x110/0x238\n  driver_register+0x64/0x128\n  __pci_register_driver+0x50/0x60\n  cdns3_pci_driver_init+0x28/0x38\n  do_one_initcall+0x5c/0x280\n  do_initcalls+0x104/0x1d8\n  kernel_init_freeable+0x140/0x218\n  kernel_init+0x28/0x1f8\n  ret_from_fork+0x10/0x20\n\nReturn -EPROBE_DEFER in this case so that probing is retried after\nthe first function has completed its probe.","score":null,"severity":"unknown","published":"2026-10-18T15:47:42.085Z","modified":"2026-10-30T12:39:26.925Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Linux","name":"Linux","platforms":[],"versions":[{"version":"7733f6c32e36ff9d7adadf40001039bf219b1cbe","status":"affected","lessThan":"399b18b18f54495eeeda8d88e039e6af27d020c9","versionType":"git"},{"version":"7733f6c32e36ff9d7adadf40001039bf219b1cbe","status":"affected","lessThan":"88b473800ae11397e2e169aff2e17b041c040409","versionType":"git"},{"version":"7733f6c32e36ff9d7adadf40001039bf219b1cbe","status":"affected","lessThan":"fc13243658da9ed3c4c94aaff77c36a10f441b89","versionType":"git"},{"version":"7733f6c32e36ff9d7adadf40001039bf219b1cbe","status":"affected","lessThan":"dbdd0ca9a7eac140697a366f698a0e2bb02a06a1","versionType":"git"},{"version":"7733f6c32e36ff9d7adadf40001039bf219b1cbe","status":"affected","lessThan":"549c04df02f1bb5a10342f32e2c87f5d27c97279","versionType":"git"},{"version":"7733f6c32e36ff9d7adadf40001039bf219b1cbe","status":"affected","lessThan":"d16046f1ace2691b6a946f022fe6dc215936880b","versionType":"git"},{"version":"7733f6c32e36ff9d7adadf40001039bf219b1cbe","status":"affected","lessThan":"45b606418bae73c7cde9f0e57e5b0977c816a7c0","versionType":"git"},{"version":"7733f6c32e36ff9d7adadf40001039bf219b1cbe","status":"affected","lessThan":"e5052f2c5c73c1dcca42bafc0bc737af2b2af059","versionType":"git"}],"defaultStatus":"unaffected","cpes":[],"source":"Linux","url":"https://www.cve.org/CVERecord?id=CVE-2026-98756"},{"vendor":"Linux","name":"Linux","platforms":[],"versions":[{"version":"5.4","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.4","versionType":"semver"},{"version":"5.10.273","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.224","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.191","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.160","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.113","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.56","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.2.10","status":"unaffected","lessThanOrEqual":"7.2.*","versionType":"semver"},{"version":"7.3","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"defaultStatus":"affected","cpes":[],"source":"Linux","url":"https://www.cve.org/CVERecord?id=CVE-2026-98756"}],"remediation":[],"references":["https://git.kernel.org/stable/c/399b18b18f54495eeeda8d88e039e6af27d020c9","https://git.kernel.org/stable/c/88b473800ae11397e2e169aff2e17b041c040409","https://git.kernel.org/stable/c/fc13243658da9ed3c4c94aaff77c36a10f441b89","https://git.kernel.org/stable/c/dbdd0ca9a7eac140697a366f698a0e2bb02a06a1","https://git.kernel.org/stable/c/549c04df02f1bb5a10342f32e2c87f5d27c97279","https://git.kernel.org/stable/c/d16046f1ace2691b6a946f022fe6dc215936880b","https://git.kernel.org/stable/c/45b606418bae73c7cde9f0e57e5b0977c816a7c0","https://git.kernel.org/stable/c/e5052f2c5c73c1dcca42bafc0bc737af2b2af059"],"sources":[{"name":"CVE","id":"CVE-2026-98756","modified":"2026-10-30T12:39:26.925Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-98756"}],"assessments":[],"sourceAffected":[],"observedAt":"2026-10-30T14:05:01.148Z","kev":{"status":"not-listed","checkedAt":"2026-11-14T23:55:31.093Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[],"aiSummary":null}