CVE-2026-63895 usb: gadget: f_fs: copy only received bytes on short ep0 read

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ffs: copy only received bytes on short ep0 read ffsep0read allocates its control-OUT data buffer with kmalloc not kzalloc at the Length value from the Setup packet, then copies that full len to userspace regardless o...

PT-2026-61212

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the f fs gadget driver where the ffs ep0 read function allocates a control-OUT data buffer using kmalloc based on the length specified in the Setup packet. When a shor...