CVE-2026-98765 USB: gadget: dummy-hcd: Fix wait for outstanding request completions

In the Linux kernel, the following vulnerability has been resolved: USB: gadget: dummy-hcd: Fix wait for outstanding request completions The dummy-hcd driver emulates synchronizeirq by waiting until its private callbackusage counter drops to 0 with the private lock not held. This counter is...

CVE-2026-98764

The Linux kernel contains a NULL pointer dereference vulnerability within the usb gadget f_fs component, specifically in FUNCTIONFS_ENDPOINT_DESC . The issue occurs when user space initializes FunctionFS with only full-speed descriptors while the gadget operates at a higher speed (e.g., USB_SPEED...

CVE-2026-98764 usb: gadget: f_fs: Fix NULL pointer dereference in FUNCTIONFS_ENDPOINT_DESC

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ffs: Fix NULL pointer dereference in FUNCTIONFSENDPOINTDESC When user space sets up FunctionFS with only full-speed descriptors e.g., flags = FUNCTIONFSHASFSDESC and the gadget operates at a higher speed such as...

EUVD-2026-103849

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ffs: Fix NULL pointer dereference in FUNCTIONFSENDPOINTDESC When user space sets up FunctionFS with only full-speed descriptors e.g., flags = FUNCTIONFSHASFSDESC and the gadget operates at a higher speed such as...

CVE-2026-98764

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ffs: Fix NULL pointer dereference in FUNCTIONFSENDPOINTDESC When user space sets up FunctionFS with only full-speed descriptors e.g., flags = FUNCTIONFSHASFSDESC and the gadget operates at a higher speed such as...

CVE-2026-98764 usb: gadget: f_fs: Fix NULL pointer dereference in FUNCTIONFS_ENDPOINT_DESC

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ffs: Fix NULL pointer dereference in FUNCTIONFSENDPOINTDESC When user space sets up FunctionFS with only full-speed descriptors e.g., flags = FUNCTIONFSHASFSDESC and the gadget operates at a higher speed such as...

Linux Distros Unpatched Vulnerability : CVE-2026-98764

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - usb: gadget: ffs: Fix NULL pointer dereference in FUNCTIONFSENDPOINTDESC When user space sets up FunctionFS with only full-speed descriptors e.g., flags =...

Linux Distros Unpatched Vulnerability : CVE-2026-98769

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - usb: gadget: fuac1legacy: validate bRequest index in genericset,getcmd genericsetcmd and genericgetcmd use the low nibble of ctrl-bRequest as an index into...

Linux Distros Unpatched Vulnerability : CVE-2026-98766

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - usb: gadget: aspeed-vhub: cancel wake work on device removal wakework is armed from the gadget .wakeup callback to resume suspended downstream ports, and it is...

PT-2026-116985

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: aspeed-vhub: cancel wake work on device removal wake work is armed from the gadget .wakeup callback to resume suspended downstream ports, and it is never cancelled in ast vhub remove, so a work item queued before or...

CVE-2026-98766: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: aspeed-vhub: cancel wake work on device removal wakework is armed from the gadget .wakeup callback to resume suspended downstream ports, and it is never cancelled in astvhubremove, so a work item queued before or...

CVE-2026-98769: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fuac1legacy: validate bRequest index in genericset,getcmd genericsetcmd and genericgetcmd use the low nibble of ctrl-bRequest as an index into con-data: u8 cmd = ctrl-bRequest & 0x0F; / 0 .. 15 / ... con-datacmd =...

PT-2026-116983

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f fs: Fix NULL pointer dereference in FUNCTIONFS ENDPOINT DESC When user space sets up FunctionFS with only full-speed descriptors e.g., flags = FUNCTIONFS HAS FS DESC and the gadget operates at a higher speed such a...

CVE-2026-98764: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ffs: Fix NULL pointer dereference in FUNCTIONFSENDPOINTDESC When user space sets up FunctionFS with only full-speed descriptors e.g., flags = FUNCTIONFSHASFSDESC and the gadget operates at a higher speed such as...

CVE-2026-98765: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: USB: gadget: dummy-hcd: Fix wait for outstanding request completions The dummy-hcd driver emulates synchronizeirq by waiting until its private callbackusage counter drops to 0 with the private lock not held. This counter is...

CVE-2026-98770: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: midi2: Fix the jack descriptor array sizes The jack in/out descriptor arrays in struct fmidi2usbconfig have the size of MAXCABLES, which look reasonable -- but it turned out to be incorrect. Namely, the entries for...

PT-2026-116988

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f uac1 legacy: validate bRequest index in generic set,get cmd generic set cmd and generic get cmd use the low nibble of ctrl-bRequest as an index into con-data: u8 cmd = ctrl-bRequest & 0x0F; / 0 .. 15 /...

PT-2026-116989

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: midi2: Fix the jack descriptor array sizes The jack in/out descriptor arrays in struct f midi2 usb config have the size of MAX CABLES, which look reasonable -- but it turned out to be incorrect. Namely, the entries f...

Linux Kernel Security Vulnerabilities

The Linux kernel version 6.6 contains security vulnerabilities. These vulnerabilities stem from inconsistent sizes of the jack input/output descriptor arrays in the midi2 USB gadget. This could lead to out-of-bound access when configuring a large number of jacks using configfs...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: usb: gadget: uvc: Fixing dangling pointers in uvcfunctionbind and uvcfunctionunbind In the error path of uvcfunctionbind, we use usbepfreerequest, which uses uvc-controlreq but does not set it to NULL afterward. As a result,...