CVE-2026-80854

CVE-2026-80854 affects the Linux kernel USB gadget f_tcm (TCM backend) driver. The root cause is a race condition : usbg_port_unlink() decrements tpg_port_count in the fabric_pre_unlink() callback, before core_dev_del_lun() finishes draining active se_lun references. If the last-LUN unlink overla...

EUVD-2026-71304

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ftcm: keep port count until LUN teardown completes tcmusbgdropnexus permits session removal once tpgportcount reaches zero. However, usbgportunlink currently decrements that count from the fabricpreunlink callback,...

CVE-2026-80854

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ftcm: keep port count until LUN teardown completes tcmusbgdropnexus permits session removal once tpgportcount reaches zero. However, usbgportunlink currently decrements that count from the fabricpreunlink callback,...

f_hid-4.14-backports

Linux 4.14.190（SM-A525F）向け fhid バックポート drivers/usb/gadget/function/fhid.c に対する3つの修正を、4.14.190 の Android ベンダーカーネルに手作業で移植し、実際に動作するデバイス上で検証しました。 4.14 はサポート終了（EOL）です。...

inspector-gadget

inspector-gadget root@kitploit: Go Go Gadget Exploit! ..--"\ |""--.. .-' \ | '-. / |...----'\ |,,..--""--.. | '\ .--'.I. ''--..' ''",JGS/|,---' ,' .::-. ', ' ,'-;oIo;-', ' - | = | | | ; .. ; ..-;|\ - /|;-. -' / \// \ '- / ; /-'; \ ; .--| |O O |'-./ ; |/ \ ;OO/ | | \ II / | \ / |O O \ / / | ...

d-os-descriptor

d-os-descriptor 概要 USB Gadget サブシステムには、compositesetup 関数 composite.c の OS ディスクリプタ処理セクションにセキュリティ上の問題が含まれています。巧妙に細工された制御転送要求メッセージを処理すると、null ポインタ参照またはメモリ破損によってデバイスがクラッシュします。 説明 interface レシピエント向けの compositesetup の OS ディスクリプタ処理セクションは、次のように実装されています。 root@kitploit: case USBRECIPINTERFACE: if windex !=...

rndis-co

RNDIS-CO 概述 RNDIS USB Gadget 可能被利用，通过数据包过滤器更新机制 转储内核内存空间的内容。 描述 RNDISMSGSET USB 控制传输请求处理程序 - rndissetresponse 调用 genndissetresp，传入的缓冲区指针偏移量为 BufOffset + 8。 BufOffset 变量从 RNDIS 消息中获取，并且未经验证 以遵守缓冲区边界。因此，通过操纵四个字节的 rndissetmsgtype 的 InformationBufferOffset 成员，攻击者可以 将实际缓冲区偏移最多 0xffffffff 字节。 rndis.c -...

linux-kernel-codex-harness

Kernel Codex Harness 한국어 | English 研究ツール · 初回インポート: 2026年4月3日 · ドキュメント改訂: 2026年7月11日 中核哲学 — 外部シグナル モデル推論の外部で計算された再現可能な観測値に注意を向けさせ、優先度を証明と誤解してはならない。 プロジェクトの状態。...

CVE-2019-14079

AndroidでのUSBデバイスファジング CVE-2019-14079 このブログ記事は、USBデバイスファジングを使用して私のAndroidデバイス（MI A2 - ストックAndroid搭載）で発見した単純なバグについてであり、Googleによって深刻度「高」と評価されました。このバグはQualcomm USBドライバに存在し、後に修正され、2020年3月のAndroidセキュリティ情報で開示されました。この脆弱性は、細工されたUSBリクエストをAndroidスマートフォンに送信すると、Androidカーネルがクラッシュし、スマートフォンが再起動するというものです。...

android-gadget

android-gadget 概要 Android で使用される Linux カーネルの一部のリビジョンは、CVE-2021-39685 の影響を受けます。 CVE-2021-39685 の詳細情報と POC は、inspector-gadget リポジトリにあります。 このリポジトリには、Android 固有のいくつかの USB gadget を対象とする POC が含まれています: faccessory faudiosource fgsi fmtp fqcrndis frmnet 説明 a faccessory composite.c で割り当てられる EP0 バッファは...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098816)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098816 advisory. In the Linux kernel, the following vulnerability has been resolved: usb: gadget: facm: Refactor bind path to use free After an bind/unbind cycle, the acm-notifyreq i...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-099014)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099014 advisory. In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fecm: Refactor bind path to use free After an bind/unbind cycle, the ecm-notifyreq i...

The vulnerability of the eth_get_drvinfo() function in the drivers/usb/gadget/function/u_ether.c module of the Linux operating system’s USB device driver allows a hacker to cause a service failure.

The vulnerability of the ethgetdrvinfo function in the drivers/usb/gadget/function/uether.c file of the Linux device driver module is related to pointer manipulation. Exploiting this vulnerability could allow an attacker to cause a service failure...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098838)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098838 advisory. In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ffs: Remove WARNON in functionfsbind This commit addresses an issue related to below...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098970)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098970 advisory. In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fncm: Refactor bind path to use free After an bind/unbind cycle, the ncm-notifyreq i...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098980)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098980 advisory. In the Linux kernel, the following vulnerability has been resolved: usb: gadget: frndis: Refactor bind path to use free After an bind/unbind cycle, the rndis-notifyr...

The vulnerability of the gadget_unbind_driver() function in the drivers/usb/gadget/udc/core.c file of the Linux operating system’s USB device driver module allows a hacker to cause a service failure.

The vulnerability of the gadgetunbinddriver function in the drivers/usb/gadget/udc/core.c file of the Linux USB device driver module is related to synchronization errors when using shared resources. Exploiting this vulnerability could allow a attacker to cause service failures...

The vulnerability of the ncm_unwrap_ntb() function in the driver/usb/gadget/function/f_ncm.c file of the Linux operating system’s USB device driver allows a hacker to cause a service failure.

The vulnerability of the ncmunwrapntb function in the driver/usb/gadget/function/fncm.c file of the Linux device driver framework is related to the possibility of integer overflow. Exploiting this vulnerability could allow an attacker to cause a service failure...

CVE-2026-74679

A flaw was found in the Linux kernel's USB gadget NCM Network Control Model function fncm. A malicious host can exploit an integer overflow vulnerability by supplying a large offset. This overflow causes a signed index variable to become negative, bypassing security checks and leading to an...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: USB: gadget: Fixed the memory leak in the rawgadget driver. Currently, increasing rawdev-count occurs before invoking rawqueueevent. If rawqueueevent returns an error, invoking rawrelease will not trigger devfree to be called...