CVE-2026-31756: usb: dwc2: gadget: Fix spin_lock/unlock mismatch in dwc2_hsotg_udc_stop()

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-05-01 · updated 2026-06-17
Weakness: CWE-667

Description

In the Linux kernel, the following vulnerability has been resolved: usb: dwc2: gadget: Fix spin_lock/unlock mismatch in dwc2_hsotg_udc_stop() dwc2_gadget_exit_clock_gating() internally calls call_gadget() macro, which expects hsotg->lock to be held since it does spin_unlock/spin_lock around the gadget driver callback invocation. However, dwc2_hsotg_udc_stop() calls dwc2_gadget_exit_clock_gating() without holding the lock. This leads to: - spin_unlock on a lock that is not held (undefined behavior) - The lock remaining held after dwc2_gadget_exit_clock_gating() returns, causing a deadlock when spin_lock_irqsave() is called later in the same function. Fix this by acquiring hsotg->lock before calling dwc2_gadget_exit_clock_gating() and releasing it afterwards, which satisfies the locking requirement of the call_gadget() macro.

Affected products

Linux kernel: from 5.15.187 before 5.15.203; from 6.1.143 before 6.1.168; from 6.6.96 before 6.6.134; from 6.12.36 before 6.12.81; from 6.15.5 before 6.18.22; from 6.19 before 6.19.12 — fixed in 5.15.203, 6.1.168, 6.12.81, 6.18.22, 6.19.12, 6.6.134

How to fix

Upgrade to a fixed version: Linux kernel 5.15.203, 6.1.168, 6.12.81, 6.18.22. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-31756 or the next vulnerability affects your stack