CVE-2026-90020: Linux

EPSS: 0.2% chance of exploitation in the next 30 days.

In the Linux kernel, the following vulnerability has been resolved: USB: gadget: fix NULL pointer dereference in gadget_dev_ioctl() gadget_dev_ioctl() reads dev->gadget before acquiring dev->lock, but dev->state is checked after acquiring the lock. Therefore a concurrent bind can change the device state between these operations, which can leave ioctl with a stale NULL gadget pointer and causing a NULL pointer dereference at gadget->ops->ioctl. Read dev->gadget while holding dev->lock so that the gadget pointer and device state are sampled consistently.

Affected products

• Linux Linux: from 2.6.12, before 5.10.270 (fixed in 5.10.270); from 5.11, before 5.15.221 (fixed in 5.15.221); from 5.16, before 6.1.188 (fixed in 6.1.188); from 6.2, before 6.6.157 (fixed in 6.6.157); from 6.7, before 6.12.110 (fixed in 6.12.110); from 6.13, before 6.18.51 (fixed in 6.18.51); …

Published 2026-09-16. Last modified 2026-09-17.