android-gadget

android-gadget 요약 Android에서 사용되는 일부 Linux 커널 개정판이 CVE-2021-39685 문제의 영향을 받습니다. CVE-2021-39685에 대한 자세한 정보와 PoC는 inspector-gadget 리포지토리에서 확인할 수 있습니다. 이 리포지토리는 Android 특정 USB 가젯 중 일부를 대상으로 하는 PoC를 포함합니다: faccessory faudiosource fgsi fmtp fqcrndis frmnet 설명 a faccessory composite.c에 할당된 EP0 버퍼는...

CVE-2026-93056

A flaw was found in the Linux kernel. Specifically, within the USB gadget audio class 1 UAC1 legacy driver, a programming error related to handling string attributes could lead to a critical system failure. A local attacker could trigger this vulnerability by attempting to write to certain...

SUSE CVE-2026-93122

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: uac: validate rate list length before storing UAC1 and UAC2 configfs rate-list attributes parse a comma-separated list of sampling rates and store each parsed value in fixed-size arrays. The arrays have UACMAXRATES...

CVE-2026-93122: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: uac: validate rate list length before storing UAC1 and UAC2 configfs rate-list attributes parse a comma-separated list of sampling rates and store each parsed value in fixed-size arrays. The arrays have UACMAXRATES...

PT-2026-94918

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An array-index-out-of-bounds issue exists in the UAC1 and UAC2 configfs rate-list attributes. The system parses a comma-separated list of sampling rates and stores them in fixed-size...

PT-2026-94854

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the f uac1 legacy USB gadget driver where the UAC1 STR ATTRIBUTE macro defines configfs show/store handlers for the fn play, fn cap, and fn cntl string options. The...

CVE-2026-31720

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fuac1legacy: validate control request size faudiocomplete copies req-length bytes into a 4-byte stack variable: u32 data = 0; memcpy&data, req-buf, req-length; req-length is derived from the host-controlled USB reque...

PT-2026-36355

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A stack out-of-bounds write exists in the f audio complete function. The issue occurs because the function copies req-length bytes into a 4-byte stack variable using memcpy. Since...