3578 matches found
CVE-2026-64346
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: udc: Fix use-after-free in gadgetmatchdriver The udc structure acts as the management structure for the gadget, but their lifecycles are decoupled. A race condition exists where usbdelgadget frees the udc memory e.g....
CVE-2026-64337 usb: mtu3: unmap request DMA on queue failure
In the Linux kernel, the following vulnerability has been resolved: usb: mtu3: unmap request DMA on queue failure mtu3gadgetqueue maps the request before checking whether the QMU GPD ring can accept another transfer. the request is returned with -EAGAIN before it is linked on the endpoint request...
CVE-2026-64328 usb: gadget: f_fs: Fix DMA fence leak
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ffs: Fix DMA fence leak In ffsdmabuftransfer, a ffsdmafence object is kmalloc'd, with the underlying dmafence later initialized by dmafenceinit, which sets its kref counter to 1. Then, dmaresvaddfence gets a second...
CVE-2026-64328
CVE-2026-64328 is a DMA fence memory leak in the Linux kernel's USB gadget FunctionFS (f_fs) driver. In ffs_dmabuf_transfer(), the first reference to an ffs_dma_fence object is never released after dma_resv_add_fence() acquires a second reference, causing objects to accumulate without being freed...
EUVD-2026-48872
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ffs: Fix DMA fence leak In ffsdmabuftransfer, a ffsdmafence object is kmalloc'd, with the underlying dmafence later initialized by dmafenceinit, which sets its kref counter to 1. Then, dmaresvaddfence gets a second...
CVE-2026-64328
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ffs: Fix DMA fence leak In ffsdmabuftransfer, a ffsdmafence object is kmalloc'd, with the underlying dmafence later initialized by dmafenceinit, which sets its kref counter to 1. Then, dmaresvaddfence gets a second...
CVE-2026-64327
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ffs: Initialize epfile-in early to fix endpoint direction checks When parsing endpoint descriptors, ffsdatagotdescs generates the epsaddrmap which contains the endpoint direction. However, epfile-in was previously on...
EUVD-2026-48871
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ffs: Initialize epfile-in early to fix endpoint direction checks When parsing endpoint descriptors, ffsdatagotdescs generates the epsaddrmap which contains the endpoint direction. However, epfile-in was previously on...
CVE-2026-64327 usb: gadget: f_fs: Initialize epfile->in early to fix endpoint direction checks
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ffs: Initialize epfile-in early to fix endpoint direction checks When parsing endpoint descriptors, ffsdatagotdescs generates the epsaddrmap which contains the endpoint direction. However, epfile-in was previously on...
CVE-2026-64327
CVE-2026-64327 affects the Linux kernel USB gadget f_fs (FunctionFS) component. The root cause is that epfile->in was only initialized in ffs_func_eps_enable() (triggered on USB host connection), so early userspace ioctls such as FUNCTIONFS_DMABUF_ATTACH executed before host connection would o...
CVE-2026-64327 usb: gadget: f_fs: Initialize epfile->in early to fix endpoint direction checks
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ffs: Initialize epfile-in early to fix endpoint direction checks When parsing endpoint descriptors, ffsdatagotdescs generates the epsaddrmap which contains the endpoint direction. However, epfile-in was previously on...
SUSE CVE-2026-64233
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: uvc: hold opts-lock across XU walks in uvcfunctionbind uvcfunctionbind walks &opts-extensionunits twice without holding opts-lock: - directly, for the iExtension string-descriptor fixup loop; - indirectly, four times...
SUSE CVE-2026-64242
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: net2280: Fix double free in probe error path usbinitializegadget installs gadgetrelease as the release callback for the embedded gadget device. The struct net2280 instance is therefore released through gadgetrelease...
PT-2026-64726
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw exists in the RNDIS Remote Network Driver Interface Specification gadget function. The rndis rm hdr function fails to verify the length of the RNDIS header before accessing its...
Linux Distros Unpatched Vulnerability : CVE-2026-64345
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - usb: gadget: fprinter: take kref only for successful open printeropen returns -EBUSY when the character device is already open, but it increments dev-kref...
PT-2026-64566
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A reference leak occurs in the usb gadget f printer component. The printer open function increments the dev-kref variable regardless of whether the open operation is successful. When the...
Linux Distros Unpatched Vulnerability : CVE-2026-64327
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ffs: Initialize epfile-in early to fix endpoint direction checks When parsing...
Linux Distros Unpatched Vulnerability : CVE-2026-64505
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - usb: gadget: function: rndis: add length check for header Add a length check for the rndis header in rndisrmhdr, to ensure that MessageType, MessageLength,...
Linux Distros Unpatched Vulnerability : CVE-2026-64347
"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - usb: gadget: composite: fix dead empty check in the USBDTOTG handler The OTG branch of compositesetup falls back to the first configuration when none is...
Linux Distros Unpatched Vulnerability : CVE-2026-64454
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - usb: dwc3: run gadget disconnect from sleepable suspend context dwc3gadgetsuspend takes dwc-lock with IRQs disabled and then calls dwc3disconnectgadget. For asy...