CVE-2026-63895

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ffs: copy only received bytes on short ep0 read ffsep0read allocates its control-OUT data buffer with kmalloc not kzalloc at the Length value from the Setup packet, then copies that full len to userspace regardless o...

CVE-2026-63895

Summary: CVE-2026-63895 affects the Linux kernel's FunctionFS (f_fs) gadget driver. The bug occurs in ffs_ep0_read(), where a control-OUT request’s data buffer is allocated with kmalloc(len) and then fully copied to userspace via copy_to_user(buf, data, len) even when only ret bytes were actually...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-988808)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-988808 advisory. In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ffs: Prevent race during ffsep0queuewait While performing fast composition switch,...