CVE-2026-64327

A flaw was found in the Linux kernel's FunctionFS ffs module, which handles USB gadget functionality. This vulnerability occurs because the endpoint direction epfile-in was not correctly initialized until a USB host connected. Consequently, early operations initiated by userspace programs could...

SUSE CVE-2026-64327

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ffs: Initialize epfile-in early to fix endpoint direction checks When parsing endpoint descriptors, ffsdatagotdescs generates the epsaddrmap which contains the endpoint direction. However, epfile-in was previously on...

SUSE CVE-2026-64331

In the Linux kernel, the following vulnerability has been resolved: usbip: vudc: fix NULL deref in vepdequeue vepallocrequest wasn't initializing vrequest-udc, so cancellations on the FunctionFS AIO path were arriving in vepdequeue without a valid UDC reference. Since vrequest-udc is never actual...

CVE-2026-64331

In the Linux kernel, the following vulnerability has been resolved: usbip: vudc: fix NULL deref in vepdequeue vepallocrequest wasn't initializing vrequest-udc, so cancellations on the FunctionFS AIO path were arriving in vepdequeue without a valid UDC reference. Since vrequest-udc is never actual...

UBUNTU-CVE-2026-64327

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ffs: Initialize epfile-in early to fix endpoint direction checks When parsing endpoint descriptors, ffsdatagotdescs generates the epsaddrmap which contains the endpoint direction. However, epfile-in was previously on...

CVE-2026-64327

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ffs: Initialize epfile-in early to fix endpoint direction checks When parsing endpoint descriptors, ffsdatagotdescs generates the epsaddrmap which contains the endpoint direction. However, epfile-in was previously on...

CVE-2026-64331

In the Linux kernel, the following vulnerability has been resolved: usbip: vudc: fix NULL deref in vepdequeue vepallocrequest wasn't initializing vrequest-udc, so cancellations on the FunctionFS AIO path were arriving in vepdequeue without a valid UDC reference. Since vrequest-udc is never actual...

CVE-2026-64331

CVE-2026-64331 is a NULL pointer dereference in the Linux kernel's usbip vudc subsystem. The root cause is that vep_alloc_request() never initialized vrequest->udc, so when FunctionFS AIO cancellations arrived in vep_dequeue, a NULL UDC reference caused a kernel oops. The bug reportedly existe...

CVE-2026-64331 usbip: vudc: fix NULL deref in vep_dequeue()

In the Linux kernel, the following vulnerability has been resolved: usbip: vudc: fix NULL deref in vepdequeue vepallocrequest wasn't initializing vrequest-udc, so cancellations on the FunctionFS AIO path were arriving in vepdequeue without a valid UDC reference. Since vrequest-udc is never actual...

CVE-2026-64331 usbip: vudc: fix NULL deref in vep_dequeue()

In the Linux kernel, the following vulnerability has been resolved: usbip: vudc: fix NULL deref in vepdequeue vepallocrequest wasn't initializing vrequest-udc, so cancellations on the FunctionFS AIO path were arriving in vepdequeue without a valid UDC reference. Since vrequest-udc is never actual...

CVE-2026-64327

CVE-2026-64327 affects the Linux kernel USB gadget f_fs (FunctionFS) component. The root cause is that epfile->in was only initialized in ffs_func_eps_enable() (triggered on USB host connection), so early userspace ioctls such as FUNCTIONFS_DMABUF_ATTACH executed before host connection would o...

CVE-2026-64331: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: usbip: vudc: fix NULL deref in vepdequeue vepallocrequest wasn't initializing vrequest-udc, so cancellations on the FunctionFS AIO path were arriving in vepdequeue without a valid UDC reference. Since vrequest-udc is never actual...

Linux Distros Unpatched Vulnerability : CVE-2026-64331

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - usbip: vudc: fix NULL deref in vepdequeue vepallocrequest wasn't initializing vrequest-udc, so cancellations on the FunctionFS AIO path were arriving in...

CVE-2026-63895

A flaw was found in the Linux kernel's FunctionFS ffs driver. This vulnerability allows a privileged gadget daemon to receive uninitialized kernel memory slab residue due to incorrect handling of short USB control-OUT transfers. When ffsep0read processes a short control-OUT transfer, it copies mo...

CVE-2026-63894

A flaw was found in the Linux kernel's FunctionFS ffs component. A race condition exists where a Direct Memory Access Buffer DMABUF cancel operation can occur concurrently with a request completion, leading to a use-after-free vulnerability. This allows a privileged local attacker, such as a...

SUSE CVE-2026-63894

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ffs: serialize DMABUF cancel against request completion ffsepfiledmabufiocomplete calls usbepfreerequest on the completed request but leaves priv-req, the back-pointer that ffsdmabuftransfer set on submission, pointi...

CVE-2026-63894

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ffs: serialize DMABUF cancel against request completion ffsepfiledmabufiocomplete calls usbepfreerequest on the completed request but leaves priv-req, the back-pointer that ffsdmabuftransfer set on submission, pointi...

CVE-2026-63895

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ffs: copy only received bytes on short ep0 read ffsep0read allocates its control-OUT data buffer with kmalloc not kzalloc at the Length value from the Setup packet, then copies that full len to userspace regardless o...

CVE-2026-63895

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ffs: copy only received bytes on short ep0 read ffsep0read allocates its control-OUT data buffer with kmalloc not kzalloc at the Length value from the Setup packet, then copies that full len to userspace regardless o...

EUVD-2026-45668

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ffs: copy only received bytes on short ep0 read ffsep0read allocates its control-OUT data buffer with kmalloc not kzalloc at the Length value from the Setup packet, then copies that full len to userspace regardless o...