inspector-gadget

inspector-gadget Go Go Gadget Exploit! ..--"\ |""--.. .-' \ | '-. / |...----'\ |,,..--""--.. | '\ .--'.I. ''--..' ''",JGS/|,---' ,' .::-. ', ' ,'-;oIo;-', ' - | = | | | ; .. ; ..-;|\ - /|;-. -' / \// \ '- / ; /-'; \ ; .--| |O O |'-./ ; |/ \ ;OO/ | | \ II / | \ / |O O \ / / | \ / | \ / /\ \ /...

CVE-2026-114353

Hidden functionality undocumented backdoor in the root-privileged 'assistant' daemon in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a physically-present attacker with USB access to execute arbitrary OS commands as root by sending the hard-coded magic string...

CVE-2026-114353 DJI CrystalSky ZS600C USB-gadget backdoor allows root command execution

Hidden functionality undocumented backdoor in the root-privileged 'assistant' daemon in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a physically-present attacker with USB access to execute arbitrary OS commands as root by sending the hard-coded magic string...

CVE-2026-114353

The DJI CrystalSky ZS600C (firmware v0.3.9.7 through v0.6.6.9 ) on Android contains a hidden backdoor within the root-privileged 'assistant' daemon . A physically-present attacker with USB access can execute arbitrary OS commands as root by sending the hard-coded magic string dji26656677 to the U...

EUVD-2026-108980

Hidden functionality undocumented backdoor in the root-privileged 'assistant' daemon in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a physically-present attacker with USB access to execute arbitrary OS commands as root by sending the hard-coded magic string...

CVE-2019-14079

USB device fuzzing on Android CVE-2019-14079 This blog post is about a simple bug I found in my android deviceMI A2 - runs stock android using USB device fuzzing and was marked as high severity by google. The bug was in Qualcomm USB driver which was later patched and disclosed in March 2020 Andro...

CVE-2026-98770

A flaw was found in the Linux kernel's USB gadget MIDI 2.0 driver. Under-sized descriptor arrays allow a local user to trigger an out-of-bounds memory access when setting up a large number of MIDI jacks through the configuration filesystem configfs. This issue primarily results in memory corrupti...

CVE-2026-98767

A flaw was found in the Linux kernel's DWC3 USB gadget driver. When an invalid event buffer count exceeding the buffer size is encountered, the driver fails to acknowledge and clear the hardware interrupt source before returning. This leaves the interrupt line continuously asserted, triggering an...

rndis-co

RNDIS-CO Summary The RNDIS USB Gadget may be exploited to dump contents of kernel memory space via packet filter update mechanism. Description The RNDISMSGSET usb control transfer request handler - rndissetresponse calls genndissetresp passing a buffer pointer offset by BufOffset + 8. The BufOffs...

PT-2026-122095

Hidden functionality undocumented backdoor in the root-privileged 'assistant' daemon in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a physically-present attacker with USB access to execute arbitrary OS commands as root by sending the hard-coded magic string...

d-os-descriptor

d-os-descriptor Summary The USB Gadget Subsystem includes security issues in the OS descriptor handling section of compositesetup function composite.c. Processing of properly crafted control transfer request messages result in device crash due to null pointer dereference or memory corruption...

SUSE CVE-2026-98770

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: midi2: Fix the jack descriptor array sizes The jack in/out descriptor arrays in struct fmidi2usbconfig have the size of MAXCABLES, which look reasonable -- but it turned out to be incorrect. Namely, the entries for...

CVE-2026-90020

A flaw was found in the Linux kernel's USB gadget subsystem. A race condition in the gadgetdevioctl function, where a pointer is read before a lock is acquired, can lead to a null pointer dereference. A local attacker could exploit this timing issue during a concurrent bind operation, potentially...

SUSE CVE-2026-98764

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ffs: Fix NULL pointer dereference in FUNCTIONFSENDPOINTDESC When user space sets up FunctionFS with only full-speed descriptors e.g., flags = FUNCTIONFSHASFSDESC and the gadget operates at a higher speed such as...

CVE-2026-90019

A flaw was found in the Linux kernel. A null pointer dereference can occur in the usbputfunctioninstance function within the USB gadget subsystem. This issue arises because a file descriptor fd is not allocated before being dereferenced in an error path, which can lead to a system crash. A local...

f_hid-4.14-backports

fhid backports for Linux 4.14.190 SM-A525F Three fixes to drivers/usb/gadget/function/fhid.c, carried by hand to a 4.14.190 Android vendor kernel and verified on the device they run on. 4.14 is end-of-life. No stable backport exists for any of these, and none is coming. That is the whole reason...

CVE-2026-93121

A flaw was found in the Linux kernel's USB gadget function filesystem ffs component. Specifically, an issue in the ffsdmabuftransfer function's error handling can lead to undefined behavior. This occurs when a fence object is prematurely deallocated without proper initialization, potentially...

CVE-2026-93120

A flaw was found in the Linux kernel's USB gadget configfs component. This out-of-bounds read vulnerability occurs when the osdescqwsignshow function incorrectly handles string length during conversion. A local attacker could potentially exploit this to read sensitive information from memory,...

CVE-2026-93141

A flaw was found in the r8a66597 USB gadget driver in the Linux kernel. This vulnerability occurs in the r8a66597probe function during an error handling path, where the ep0req object is erroneously freed twice if usbaddgadgetudc fails. This double free can lead to memory corruption, potentially...

CVE-2026-93118

A flaw was found in the Linux kernel's USB gadget driver for Aspeed UDC. During the device initialization process, a failure to allocate a Direct Memory Access DMA buffer is not properly handled. This can lead to the driver attempting to use an invalid memory address, potentially causing a system...