Null Pointer Dereference Vulnerability in Linux Kernel - CVE-2026-90019
Summary
DEBIAN-CVE-2026-90019: In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fix null pointer dereference in usb_put_function_instance() usb_put_function_instance() attempts to dereference fd inside fi struct to get... Affects linux versions 6.1.106-1 – 7.2~rc7-1~exp1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware and software interactions. It is known for its robustness, flexibility, and extensive support for various hardware architectures. However, like any complex software, it is susceptible to vulnerabilities that can compromise system integrity and security. CVE-2026-90019 specifically affects the USB gadget subsystem, which is responsible for managing USB devices in the Linux environment.
Vulnerability Detail
CVE-2026-90019 is a null pointer dereference vulnerability found in the usb_put_function_instance() function of the Linux kernel. This issue arises when the function attempts to dereference a file descriptor (fd) within a function instance (fi) structure that has not yet been allocated. As a result, if an error occurs during the allocation process, the function will attempt to access a null pointer, leading to potential crashes or undefined behavior. This vulnerability can be exploited by attackers to cause denial of service or to manipulate the USB subsystem, potentially leading to further security breaches.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. It is advisable to apply the patch as soon as it becomes available to mitigate risks associated with this issue.
Conclusion
CVE-2026-90019 is a critical vulnerability in the Linux kernel that requires immediate attention. By updating to the latest patched version of the Linux package, users can protect their systems from potential exploitation. It is essential to stay informed about vulnerabilities and apply updates promptly to maintain system security.
See every vulnerability recorded for linux →
FAQ
CVE-2026-90019 is a vulnerability in the Linux kernel that involves a null pointer dereference in the USB gadget subsystem.
This vulnerability can lead to system crashes or undefined behavior, potentially allowing attackers to exploit the USB subsystem.
If you are using a version of the Linux kernel that is part of Debian 12, 13, or 14, you may be affected. Use tools like Vulert to check your application for vulnerabilities.
The best protection is to update your Linux package to the latest version that includes the patch for this vulnerability.
You can find detailed information about CVE-2026-90019 in the official Debian security advisories or on vulnerability databases.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
