PT-2026-64568 · Linux · Linux

CVE-2026-64347

·

Published

2026-07-25

·

Updated

2026-07-25

None

No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: composite: fix dead empty check in the USB DT OTG handler
The OTG branch of composite setup() falls back to the first configuration when none is selected:
if (cdev->config)
	config = cdev->config;
else
	config = list first entry(&cdev->configs,
				 struct usb configuration, list);
if (!config)
	goto done;
...
memcpy(req->buf, config->descriptors[0], value);
list first entry() never returns NULL. On an empty list it returns container of() of the list head. So the "if (!config)" check is dead.
When cdev->configs is empty, config points at the head inside struct usb composite dev. config->descriptors[0] reads whatever sits at that offset. The memcpy copies up to w length bytes of it into the response buffer.
cdev->configs can be empty in two cases. One is a teardown race on gadget unbind with a control transfer in flight. The other is a driver that sets is otg before it adds a config. A reproducer that holds cdev->configs empty triggers a KASAN fault in this branch.
Use list first entry or null() so the existing check does its job.
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Related Identifiers

CVE-2026-64347

Affected Products

Linux