GHSA-F6GG-FR3W-RQH2

Vulnerability from github – Published: 2026-07-25 12:31 – Updated: 2026-07-25 12:31
VLAI
Details

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: composite: fix dead empty check in the USB_DT_OTG handler

The OTG branch of composite_setup() falls back to the first configuration when none is selected:

if (cdev->config)
    config = cdev->config;
else
    config = list_first_entry(&cdev->configs,
                  struct usb_configuration, list);
if (!config)
    goto done;
...
memcpy(req->buf, config->descriptors[0], value);

list_first_entry() never returns NULL. On an empty list it returns container_of() of the list head. So the "if (!config)" check is dead.

When cdev->configs is empty, config points at the head inside struct usb_composite_dev. config->descriptors[0] reads whatever sits at that offset. The memcpy copies up to w_length bytes of it into the response buffer.

cdev->configs can be empty in two cases. One is a teardown race on gadget unbind with a control transfer in flight. The other is a driver that sets is_otg before it adds a config. A reproducer that holds cdev->configs empty triggers a KASAN fault in this branch.

Use list_first_entry_or_null() so the existing check does its job.

Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-64347"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-25T10:17:16Z",
    "severity": null
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: composite: fix dead empty check in the USB_DT_OTG handler\n\nThe OTG branch of composite_setup() falls back to the first\nconfiguration when none is selected:\n\n\tif (cdev-\u003econfig)\n\t\tconfig = cdev-\u003econfig;\n\telse\n\t\tconfig = list_first_entry(\u0026cdev-\u003econfigs,\n\t\t\t\t\t  struct usb_configuration, list);\n\tif (!config)\n\t\tgoto done;\n\t...\n\tmemcpy(req-\u003ebuf, config-\u003edescriptors[0], value);\n\nlist_first_entry() never returns NULL. On an empty list it returns\ncontainer_of() of the list head. So the \"if (!config)\" check is dead.\n\nWhen cdev-\u003econfigs is empty, config points at the head inside struct\nusb_composite_dev. config-\u003edescriptors[0] reads whatever sits at that\noffset. The memcpy copies up to w_length bytes of it into the response\nbuffer.\n\ncdev-\u003econfigs can be empty in two cases. One is a teardown race on\ngadget unbind with a control transfer in flight. The other is a driver\nthat sets is_otg before it adds a config. A reproducer that holds\ncdev-\u003econfigs empty triggers a KASAN fault in this branch.\n\nUse list_first_entry_or_null() so the existing check does its job.",
  "id": "GHSA-f6gg-fr3w-rqh2",
  "modified": "2026-07-25T12:31:32Z",
  "published": "2026-07-25T12:31:32Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64347"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/01feaf024f29618d5ffa7ab0fd858e0579dcbf7b"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/2454264b2ab4cf0055c0bfd39e79f830452bd0db"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/56add2b9b2e89ec61c0761165d758f73004fdfdf"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/8ac463fe6c0f85bdb1ce8c30e8c9e060802e4483"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/91b3ecd34b60f950c50c560974945b6596a6f207"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/d3e72cfef2e38bd588055739a8100d14f9773b17"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/f8f680609c2b3ab795ffcd6f21585b6dfc46d395"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/fcb21bf747640c9d6bd1eda9da85420f076d59c1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.