SUSE CVE-2026-63895

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ffs: copy only received bytes on short ep0 read ffsep0read allocates its control-OUT data buffer with kmalloc not kzalloc at the Length value from the Setup packet, then copies that full len to userspace regardless o...

CVE-2026-63895

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ffs: copy only received bytes on short ep0 read ffsep0read allocates its control-OUT data buffer with kmalloc not kzalloc at the Length value from the Setup packet, then copies that full len to userspace regardless o...

CVE-2026-63895 usb: gadget: f_fs: copy only received bytes on short ep0 read

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ffs: copy only received bytes on short ep0 read ffsep0read allocates its control-OUT data buffer with kmalloc not kzalloc at the Length value from the Setup packet, then copies that full len to userspace regardless o...

CVE-2026-63895

Summary: CVE-2026-63895 affects the Linux kernel's FunctionFS (f_fs) gadget driver. The bug occurs in ffs_ep0_read(), where a control-OUT request’s data buffer is allocated with kmalloc(len) and then fully copied to userspace via copy_to_user(buf, data, len) even when only ret bytes were actually...

PT-2026-61212

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the f fs gadget driver where the ffs ep0 read function allocates a control-OUT data buffer using kmalloc based on the length specified in the Setup packet. When a shor...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ffs: Prevent race conditions during ffsep0queuewait When performing fast composition switching, there is a possibility that the process of ffsep0write/ffsep0read may enter a race condition due to ep0req being freed...

SUSE CVE-2025-68287

In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: Fix race condition between concurrent dwc3removerequests call paths This patch addresses a race condition caused by unsynchronized execution of multiple call paths invoking dwc3removerequests, leading to premature...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-988808)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-988808 advisory. In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ffs: Prevent race during ffsep0queuewait While performing fast composition switch,...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-988993)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-988993 advisory. In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: ep0: fix NULL pointer exception There is no validation of the index from dwc3wIndextod...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-986556)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-986556 advisory. In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: ep0: fix NULL pointer exception There is no validation of the index from dwc3wIndextod...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-987210)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-987210 advisory. In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: ep0: fix NULL pointer exception There is no validation of the index from dwc3wIndextod...

Vulnerability of the dwc3_wIndex_to_dep() function in the drivers/usb/dwc3/ep0.c module – The USB device driver support module in the Linux kernel allows a hacker to trigger a service failure.

Vulnerability of the dwc3wIndextodep function in the drivers/usb/dwc3/ep0.c module – The Linux kernel’s USB device support driver relies on the assignment of the NULL pointer. Exploiting this vulnerability could allow an attacker to cause a service failure...

SUSE CVE-2022-49755

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ffs: Prevent race during ffsep0queuewait While performing fast composition switch, there is a possibility that the process of ffsep0write/ffsep0read get into a race condition due to ep0req being freed up from...

OESA-2024-1678 kernel security update

The Linux Kernel, the operating system core itself. Security Fixes: In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: ep0: fix NULL pointer exception There is no validation of the index from dwc3wIndextodep and we might be referring a non-existing ep and trigger a NUL...

SUSE CVE-2021-47269

In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: ep0: fix NULL pointer exception There is no validation of the index from dwc3wIndextodep and we might be referring a non-existing ep and trigger a NULL pointer exception. In certain configurations we might use fewer ep...

DEBIAN-CVE-2021-47269

In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: ep0: fix NULL pointer exception There is no validation of the index from dwc3wIndextodep and we might be referring a non-existing ep and trigger a NULL pointer exception. In certain configurations we might use fewer ep...

UBUNTU-CVE-2021-47269

In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: ep0: fix NULL pointer exception There is no validation of the index from dwc3wIndextodep and we might be referring a non-existing ep and trigger a NULL pointer exception. In certain configurations we might use fewer ep...

PT-2023-35360 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v4.14.305 Description: A potential issue exists due to a race condition during ffs ep0 queue wait. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel versions...

CVE-2021-39640

In dwc3gadgetep0queue of ep0.c, there is a possible out of bounds write due to improper locking. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID:...

PT-2021-22685 · Google · Android Kernel

Name of the Vulnerable Software and Affected Versions: Android kernel Description: The issue is related to a possible out of bounds write in the dwc3 gadget ep0 queue function of ep0.c due to improper locking. This could lead to local escalation of privilege with no additional execution privilege...