CVE-2026-31721

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fhid: move list and spinlock inits from bind to alloc There was an issue when you did the following: - setup and bind an hid gadget - open /dev/hidg0 - use the resulting fd in EPOLLCTLADD - unbind the UDC - bind the...

CVE-2026-31721

CVE-2026-31721 affects the Linux kernel USB gadget subsystem, specifically the f_hid driver. The issue arises from initializing wait queues (poll_wait) with init_waitqueue_head inside hidg_bind, which re-initializes queues that may still contain items when the HID gadget is bound/unbound and epol...

CVE-2026-31720

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fuac1legacy: validate control request size faudiocomplete copies req-length bytes into a 4-byte stack variable: u32 data = 0; memcpy&data, req-buf, req-length; req-length is derived from the host-controlled USB reque...

EUVD-2026-26533

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fuac1legacy: validate control request size faudiocomplete copies req-length bytes into a 4-byte stack variable: u32 data = 0; memcpy&data, req-buf, req-length; req-length is derived from the host-controlled USB reque...

CVE-2026-31720 usb: gadget: f_uac1_legacy: validate control request size

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fuac1legacy: validate control request size faudiocomplete copies req-length bytes into a 4-byte stack variable: u32 data = 0; memcpy&data, req-buf, req-length; req-length is derived from the host-controlled USB reque...

CVE-2026-31720 usb: gadget: f_uac1_legacy: validate control request size

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fuac1legacy: validate control request size faudiocomplete copies req-length bytes into a 4-byte stack variable: u32 data = 0; memcpy&data, req-buf, req-length; req-length is derived from the host-controlled USB reque...

CVE-2026-31720

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fuac1legacy: validate control request size faudiocomplete copies req-length bytes into a 4-byte stack variable: u32 data = 0; memcpy, req-buf, req-length; req-length is derived from the host-controlled USB request...

CVE-2026-31720

CVE-2026-31720 : In the Linux kernel, the USB gadget path f_uac1_legacy incorrectly handles control request length. Specifically, f_audio_complete() copies req->length bytes into a 4-byte stack variable (data) via memcpy, with req->length derived from host-controlled USB requests. This can ...

PT-2026-36362

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL pointer dereference occurs in the eth get drvinfo function. This happens when a gadget device is reparented to /sys/devices/virtual during an unbind process, which clears the gadg...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from the usb dwc2 gadget driver calling dwc2gadgetexitclockgating without holding a lock in the dwc2hsotgudcstop...

PT-2026-36360

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the usb gadget f ecm component where the net device is allocated during function instance creation and registered during the bind phase. When the function unbinds, the...

PT-2026-36356

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the USB gadget HID function where list and spinlock initializations were performed during the bind process. Specifically, queues registered via poll wait were...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from the usb cdns3 gadget driver not checking when the ep-desc pointer is null in the epqueue, which could result...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from an inconsistent state of the usb cdns3 gadget driver upon initialization failure, which could lead to...

PT-2026-36390

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL pointer dereference occurs in the cdns3 gadget ep queue function when a gadget endpoint is disabled or not yet configured. In these states, the ep-desc pointer can be NULL, leadin...

PT-2026-36359

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the usb gadget f eem component where the net device is allocated during function instance creation and registered during the bind phase. When the function unbinds, the...

PT-2026-36361

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition in the USB gadget UVC USB Video Class component can lead to a NULL pointer dereference. During power management transitions, the wait event interruptible timeout functio...

PT-2026-36358

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the usb gadget f subset component where the net device is allocated during function instance creation and registered during the bind phase with the gadget device as it...

PT-2026-36363

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists between the gether disconnect and eth stop functions. If eth stop is triggered concurrently while gether disconnect is tearing down endpoints, eth stop may attemp...

PT-2026-36357

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw in the USB gadget RNDIS component allows a network device to persist after the bind and unbind process, creating a zombie device. This occurs because the net device is allocated...