CVE-2026-93214

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ftcm: fix deadlock in usbgmaketpg usbgmaketpg held deplock while calling configfsdependitemunlocked, which acquires the configfs root inode lock when operating across subsystems. This creates a circular lock dependen...

Linux Distros Unpatched Vulnerability : CVE-2026-97482

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - usb: gadget: gokuudc: avoid NULL deref of dev-driver in INTUSBRESET log gokuirq handles a number of bus events under a single ep0 path. It already guards the...

SUSE CVE-2026-93056

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fuac1legacy: remove broken string configfs attributes The UAC1STRATTRIBUTE macro defines configfs show/store handlers for the fnplay, fncap, and fncntl string options. The store function contains an inverted null che...

SUSE CVE-2026-93120

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: configfs: fix out-of-bounds read of qwsign osdescqwsignshow passes OSSTRINGQWSIGNLEN as the input length to utf16stoutf8s, but that argument counts UTF-16 code units while OSSTRINGQWSIGNLEN 14 is the byte size of...

SUSE CVE-2026-93121

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ffs: Fix fence cleanup in ffsdmabuftransfer error paths The error paths for endpoint-disabled ESHUTDOWN and request-allocation failure ENOMEM in ffsdmabuftransfer jump to errfenceput which calls dmafenceput on the...

SUSE CVE-2026-93122

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: uac: validate rate list length before storing UAC1 and UAC2 configfs rate-list attributes parse a comma-separated list of sampling rates and store each parsed value in fixed-size arrays. The arrays have UACMAXRATES...

SUSE CVE-2026-89733

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: uvc: fix dangling pointers in uvcfunctionbind and uvcfunctionunbind In uvcfunctionbind error path, we use usbepfreerequest which uses uvc-controlreq but does not set it to NULL afterwards. Thus, uvc-controlreq is a...

SUSE CVE-2026-90023

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fmassstorage: fix null pointer dereference in fsgcommonsetnumbuffers Previously fsgnumbuffersvalidate was removed as it was not necessary due to Kconfig setting the limits for n from 2 to 256 with default as 2...

SUSE CVE-2026-90024

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: midi2: Fix null-pointer dereference in fmidi2freeepreqs A null-pointer dereference occurs in fmidi2freeepreqs when attempting to clean up an endpoint that was never initialized. When configuring the MIDI 2.0 gadget v...

SUSE CVE-2026-93141

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: r8a66597: avoid double free of ep0req in probe error path If usbaddgadgetudc fails, r8a66597probe jumps to erraddudc and frees ep0req, then falls through to cleanup2 where ep0req is freed again when it is non-NULL...

Linux Distros Unpatched Vulnerability : CVE-2026-93122

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - usb: gadget: uac: validate rate list length before storing UAC1 and UAC2 configfs rate-list attributes parse a comma-separated list of sampling rates and store...

Linux Distros Unpatched Vulnerability : CVE-2026-93121

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - usb: gadget: ffs: Fix fence cleanup in ffsdmabuftransfer error paths The error paths for endpoint- disabled ESHUTDOWN and request-allocation failure ENOMEM in...

Linux Distros Unpatched Vulnerability : CVE-2026-93120

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - usb: gadget: configfs: fix out-of-bounds read of qwsign osdescqwsignshow passes OSSTRINGQWSIGNLEN as the input length to utf16stoutf8s, but that argument counts...

CVE-2026-93121

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ffs: Fix fence cleanup in ffsdmabuftransfer error paths The error paths for endpoint-disabled ESHUTDOWN and request-allocation failure ENOMEM in ffsdmabuftransfer jump to errfenceput which calls dmafenceput on the...

AZL-102551 CVE-2026-93120 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: configfs: fix out-of-bounds read of qwsign osdescqwsignshow passes OSSTRINGQWSIGNLEN as the input length to utf16stoutf8s, but that argument counts UTF-16 code units while OSSTRINGQWSIGNLEN 14 is the byte size of...

DEBIAN-CVE-2026-93122

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: uac: validate rate list length before storing UAC1 and UAC2 configfs rate-list attributes parse a comma-separated list of sampling rates and store each parsed value in fixed-size arrays. The arrays have UACMAXRATES...

SUSE CVE-2026-90019

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fix null pointer dereference in usbputfunctioninstance usbputfunctioninstance attempts to dereference fd inside fi struct to get mod in uvcallocinst error path. However, fd is not allocated until later in...

SUSE CVE-2026-90020

In the Linux kernel, the following vulnerability has been resolved: USB: gadget: fix NULL pointer dereference in gadgetdevioctl gadgetdevioctl reads dev-gadget before acquiring dev-lock, but dev-state is checked after acquiring the lock. Therefore a concurrent bind can change the device state...

SUSE CVE-2026-90022

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fmidi2: fix use-after-free in string attribute show path fmidi2optsstrshow takes the string lock internally, but its callers dereference the opts-info. pointer before calling it, outside the lock. This races with...

SUSE CVE-2026-90045

In the Linux kernel, the following vulnerability has been resolved: USB: gadget: ffs: fix mm lifetime handling iodata stores a pointer to the submitting task's mmstruct, but does not currently hold a reference to it while async requests are pending. This can result in a use-after-free if the task...