PT-2026-64568 · Linux · Linux

CVE-2026-64347

·

Publicado

2026-07-25

·

Atualizado

2026-07-25

Nenhuma

Não há classificações de severidade ou métricas disponíveis. Quando houver, atualizaremos as informações correspondentes na página.
In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: composite: fix dead empty check in the USB DT OTG handler
The OTG branch of composite setup() falls back to the first configuration when none is selected:
if (cdev->config)
	config = cdev->config;
else
	config = list first entry(&cdev->configs,
				 struct usb configuration, list);
if (!config)
	goto done;
...
memcpy(req->buf, config->descriptors[0], value);
list first entry() never returns NULL. On an empty list it returns container of() of the list head. So the "if (!config)" check is dead.
When cdev->configs is empty, config points at the head inside struct usb composite dev. config->descriptors[0] reads whatever sits at that offset. The memcpy copies up to w length bytes of it into the response buffer.
cdev->configs can be empty in two cases. One is a teardown race on gadget unbind with a control transfer in flight. The other is a driver that sets is otg before it adds a config. A reproducer that holds cdev->configs empty triggers a KASAN fault in this branch.
Use list first entry or null() so the existing check does its job.
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Identificadores relacionados

CVE-2026-64347

Produtos afetados

Linux