CVE-2019-14079

Android 上的 USB 设备模糊测试（CVE-2019-14079） 这篇博客文章是关于我在我的安卓设备（MI A2 - 运行原生安卓）上通过 USB 设备模糊测试发现的一个简单漏洞，谷歌将其标记为高严重性。该漏洞存在于高通 USB 驱动中，后来在 2020 年 3 月的安卓公告中被修补并披露。关于该漏洞，当你向安卓手机发送精心构造的 USB 请求时，会导致安卓内核崩溃，手机重启。 这个漏洞是由于 USB gadget 的 'core.c' 中使用了一个未初始化的变量。漏洞详情可以在以下高通安全公告和 2020 年 3 月安卓公告中找到。...

CVE-2026-74679

A flaw was found in the Linux kernel's USB gadget NCM Network Control Model function fncm. A malicious host can exploit an integer overflow vulnerability by supplying a large offset. This overflow causes a signed index variable to become negative, bypassing security checks and leading to an...

CVE-2026-74679

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fncm: Use unsigned int for ndpindex The variable ndpindex is declared as a signed integer, but it stores the return value of getncm, which is unsigned. A malicious host can supply a large offset that overflows the...

CVE-2026-74679

CVE-2026-74679 affects the Linux kernel USB gadget NCM function (f_ncm). The variable ndp_index is declared as a signed integer but stores the unsigned return value of get_ncm(). A malicious host can supply a large offset that overflows the signed ndp_index, making it negative. Because the value ...

CVE-2026-74679 usb: gadget: f_ncm: Use unsigned int for ndp_index

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fncm: Use unsigned int for ndpindex The variable ndpindex is declared as a signed integer, but it stores the return value of getncm, which is unsigned. A malicious host can supply a large offset that overflows the...

CVE-2026-74679 usb: gadget: f_ncm: Use unsigned int for ndp_index

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fncm: Use unsigned int for ndpindex The variable ndpindex is declared as a signed integer, but it stores the return value of getncm, which is unsigned. A malicious host can supply a large offset that overflows the...

EUVD-2026-64366

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fncm: Use unsigned int for ndpindex The variable ndpindex is declared as a signed integer, but it stores the return value of getncm, which is unsigned. A malicious host can supply a large offset that overflows the...

PT-2026-79684

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f ncm: Use unsigned int for ndp index The variable ndp index is declared as a signed integer, but it stores the return value of get ncm, which is unsigned. A malicious host can supply a large offset that overflows th...

d-os-descriptor

d-os-descriptor 概述 USB小工具子系统在compositesetup函数（composite.c）的OS描述符处理部分存在安全问题。处理精心构造的控制传输请求消息会因空指针解引用或内存损坏而导致设备崩溃。 描述 compositesetup中针对接口接收者的OS描述符处理部分实现如下。 root@kitploit: case USBRECIPINTERFACE: if windex != 0x5 || wvalue 8 break; interface = wvalue & 0xFF; buf6 = windex; count =...

rndis-co

RNDIS-CO 概述 RNDIS USB Gadget 可能被利用，通过数据包过滤器更新机制 转储内核内存空间的内容。 描述 RNDISMSGSET USB 控制传输请求处理程序 - rndissetresponse 调用 genndissetresp，传入的缓冲区指针偏移量为 BufOffset + 8。 BufOffset 变量从 RNDIS 消息中获取，并且未经验证 以遵守缓冲区边界。因此，通过操纵四个字节的 rndissetmsgtype 的 InformationBufferOffset 成员，攻击者可以 将实际缓冲区偏移最多 0xffffffff 字节。 rndis.c -...

SUSE CVE-2026-68369

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: printer: fix infinite loop in printerread printerread uses the same variable for the requested copy size and the number of bytes actually copied to user space. copytouser returns the number of bytes not copied, so wh...

The vulnerability of the functions __cdnsp_gadget_init() and cdnsp_gadget_exit() in the kernel module drivers/usb/cdns3/cdnsp-gadget.c of the Linux operating system allows a hacker to cause a service failure.

The vulnerability of the functions cdnspgadgetinit and cdnspgadgetexit in the kernel module drivers/usb/cdns3/cdnsp-gadget.c of the Linux operating system is related to memory initialization errors. Exploiting this vulnerability could allow an attacker to cause a service failure...

Linux Distros Unpatched Vulnerability : CVE-2026-68088

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - usb: gadget: function: rndis: add length check to response query Add variable representations for BufLength and BufOffset in rndisqueryresponse, and perform a...

CVE-2026-68369

A flaw was found in the Linux kernel's USB gadget printer driver. An attacker, by providing specific input to the printerread function, could trigger an infinite loop. This vulnerability occurs when the copytouser function fails to copy data, leading to a denial of service condition where the...

CVE-2026-68368

A flaw was found in the Linux kernel's USB gadget NCM Network Control Model driver. This vulnerability occurs because the driver fails to properly validate the boundaries of datagrams and Network Transfer Blocks NTBs supplied by a USB host. A malicious USB host can exploit this by crafting specif...

CVE-2026-68367

A flaw was found in the Linux kernel's USB gadget function ftcm. A local attacker could exploit a race condition during the teardown of a USB gadget function. This could lead to a use-after-free vulnerability, potentially causing a system crash denial of service or, in more severe cases, arbitrar...

CVE-2026-68370

A flaw was found in the Linux kernel's USB gadget dummy Host Controller Driver HCD. A race condition can occur when a shared USB request object fiforeq is prematurely reused before its completion callback has finished. This can lead to the overwriting of the callback pointer, causing a general...

CVE-2026-68369

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: printer: fix infinite loop in printerread printerread uses the same variable for the requested copy size and the number of bytes actually copied to user space. copytouser returns the number of bytes not copied, so wh...

DEBIAN-CVE-2026-68367

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ftcm: synchronize delayed setalt with teardown The ftcm setalt path defers endpoint setup to a work item and completes the delayed status response from process context. The delayed work uses ftcm private state and ma...

CVE-2026-68366

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: uvc: clamp SENDRESPONSE length to the response buffer uvcsendresponse builds the UVC control response from a user-supplied struct uvcrequestdata: req-length = mintunsigned int, uvc-eventlength, data-length;...