{"id":"AZL-103871","summary":"CVE-2026-97482 affecting package kernel 6.6.157.1-1","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: goku_udc: avoid NULL deref of dev-\u003edriver in INT_USBRESET log\n\ngoku_irq() handles a number of bus events under a single ep0 path.\nIt already guards the gadget driver suspend/resume callbacks against a\nNULL -\u003edriver:\n\n\tif (dev-\u003egadget.speed != USB_SPEED_UNKNOWN\n\t\t\t&& dev-\u003edriver\n\t\t\t&& dev-\u003edriver-\u003eresume) {\n\t\tspin_unlock(&dev-\u003elock);\n\t\tdev-\u003edriver-\u003eresume(&dev-\u003egadget);\n\t\t...\n\t}\n\nbut the very next branch unconditionally dereferences dev-\u003edriver\nwhen an INT_USBRESET arrives:\n\n\tif (stat & INT_USBRESET) {\n\t\tACK(INT_USBRESET);\n\t\tINFO(dev, \"USB reset done, gadget %s\\n\",\n\t\t\tdev-\u003edriver-\u003edriver.name);\n\t}\n\nIf the controller raises INT_USBRESET before any gadget driver has\nbeen bound (or after one has been unbound), dev-\u003edriver is NULL and\nthe printk dereferences NULL.\n\nsmatch flags the inconsistency:\n\n  drivers/usb/gadget/udc/goku_udc.c:1618 goku_irq() error:\n  we previously assumed 'dev-\u003edriver' could be null (see line 1607)\n\nFall back to a placeholder when the gadget driver is not bound.\n\nNo functional change while a gadget driver is bound.","modified":"2026-09-25T14:15:54.232236570Z","published":"2026-09-24T17:17:25Z","upstream":["CVE-2026-97482"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97482"}],"affected":[{"package":{"name":"kernel","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/kernel"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"6.6.157.1-1"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-103871.json"}}],"schema_version":"1.9.0"}