android-gadget

android-gadget 概要 Android で使用される Linux カーネルの一部のリビジョンは、CVE-2021-39685 の影響を受けます。 CVE-2021-39685 の詳細情報と POC は、inspector-gadget リポジトリにあります。 このリポジトリには、Android 固有のいくつかの USB gadget を対象とする POC が含まれています: faccessory faudiosource fgsi fmtp fqcrndis frmnet 説明 a faccessory composite.c で割り当てられる EP0 バッファは...

rndis-co

RNDIS-CO 요약 RNDIS USB Gadget은 패킷 필터 업데이트 메커니즘을 통해 커널 메모리 공간의 내용을 덤프하는 데 악용될 수 있습니다. 설명 RNDISMSGSET USB 제어 전송 요청 핸들러인 rndissetresponse는 genndissetresp를 호출하면서 BufOffset + 8만큼 오프셋된 버퍼 포인터를 전달합니다. BufOffset 변수는 RNDIS 메시지에서 가져오며 버퍼 경계를 준수하는지 검증되지 않습니다. 결과적으로 rndissetmsgtype의 4바이트 InformationBufferOffs...

inspector-gadget

inspector-gadget Go Go Gadget Exploit! ..--"\ |""--.. .-' \ | '-. / |...----'\ |,,..--""--.. | '\ .--'.I. ''--..' ''",JGS/|,---' ,' .::-. ', ' ,'-;oIo;-', ' - | = | | | ; .. ; ..-;|\ - /|;-. -' / \// \ '- / ; /-'; \ ; .--| |O O |'-./ ; |/ \ ;OO/ | | \ II / | \ / |O O \ / / | \ / | \ / /\ \ /...

d-os-descriptor

d-os-descriptor 요약 USB Gadget 서브시스템은 compositesetup 함수composite.c의 OS 디스크립터 처리 섹션에 보안 문제를 포함합니다. 적절하게 조작된 제어 전송 요청 메시지를 처리하면 널 포인터 역참조 또는 메모리 손상으로 인해 장치가 충돌합니다. 설명 interface 수신자에 대한 compositesetup의 OS 디스크립터 처리 섹션은 다음과 같이 구현됩니다. case USBRECIPINTERFACE: if windex != 0x5 || wvalue 8 break; interface...

f_hid-4.14-backports

fhid backports for Linux 4.14.190 SM-A525F Three fixes to drivers/usb/gadget/function/fhid.c, carried by hand to a 4.14.190 Android vendor kernel and verified on the device they run on. 4.14 is end-of-life. No stable backport exists for any of these, and none is coming. That is the whole reason...

CVE-2019-14079

Android에서의 USB 장치 퍼징 CVE-2019-14079 이 블로그 포스트는 USB 장치 퍼징을 통해 제 안드로이드 기기MI A2 - 순정 안드로이드 실행에서 발견한 간단한 버그에 관한 것이며, Google에서 높은 심각도로 분류했습니다. 이 버그는 Qualcomm USB 드라이버에 있었으며, 이후 패치되어 2020년 3월 Android 보안 게시판에 공개되었습니다. 이 취약점은 조작된 USB 요청을 안드로이드 폰에 보내면 안드로이드 커널이 충돌하여 폰이 재시작됩니다. 이 버그는 USB 가젯 "core.c"에서 초기화되...

CVE-2026-97482

A flaw was found in the Linux kernel's gokuudc USB gadget driver. An attacker or event triggering a USB reset interrupt before a gadget driver is bound, or after one is unbound, causes the interrupt handler to access an uninitialized driver pointer while logging the event. This flaw results in a...

linux-kernel-codex-harness

Kernel Codex Harness 한국어 | English Research Tool · Original Import: 3 April 2026 · Documentation Revision: 11 July 2026 Core Philosophy — External Signal Let reproducible observations outside model inference guide attention; never mistake priority for proof. Project status. 이 저장소는 실제 Linux 커널 취약점...

ROS-20260929-73-0081

The vulnerability of the checkcommandsizeinblocks function in the drivers/usb/gadget/function/fmassstorage.c file of the Linux device driver framework is related to integer overflow. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and...

Linux Distros Unpatched Vulnerability : CVE-2026-93214

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - usb: gadget: ftcm: fix deadlock in usbgmaketpg usbgmaketpg held deplock while calling configfsdependitemunlocked, which acquires the configfs root inode lock wh...

SUSE CVE-2026-93214

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ftcm: fix deadlock in usbgmaketpg usbgmaketpg held deplock while calling configfsdependitemunlocked, which acquires the configfs root inode lock when operating across subsystems. This creates a circular lock dependen...

DEBIAN-CVE-2026-93214

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ftcm: fix deadlock in usbgmaketpg usbgmaketpg held deplock while calling configfsdependitemunlocked, which acquires the configfs root inode lock when operating across subsystems. This creates a circular lock dependen...

CVE-2026-93214

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ftcm: fix deadlock in usbgmaketpg usbgmaketpg held deplock while calling configfsdependitemunlocked, which acquires the configfs root inode lock when operating across subsystems. This creates a circular lock dependen...

UBUNTU-CVE-2026-93214

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ftcm: fix deadlock in usbgmaketpg usbgmaketpg held deplock while calling configfsdependitemunlocked, which acquires the configfs root inode lock when operating across subsystems. This creates a circular lock dependen...

CVE-2026-97482 usb: gadget: goku_udc: avoid NULL deref of dev->driver in INT_USBRESET log

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: gokuudc: avoid NULL deref of dev-driver in INTUSBRESET log gokuirq handles a number of bus events under a single ep0 path. It already guards the gadget driver suspend/resume callbacks against a NULL -driver: if...

CVE-2026-97482

The Linux kernel contains a vulnerability in the goku_udc USB gadget driver where the goku_irq() function performs a NULL pointer dereference . The issue occurs when an INT_USBRESET event is received before a gadget driver is bound or after it has been unbound. In these scenarios, dev->driver ...

CVE-2026-97482 usb: gadget: goku_udc: avoid NULL deref of dev->driver in INT_USBRESET log

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: gokuudc: avoid NULL deref of dev-driver in INTUSBRESET log gokuirq handles a number of bus events under a single ep0 path. It already guards the gadget driver suspend/resume callbacks against a NULL -driver: if...

CVE-2026-93214

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ftcm: fix deadlock in usbgmaketpg usbgmaketpg held deplock while calling configfsdependitemunlocked, which acquires the configfs root inode lock when operating across subsystems. This creates a circular lock dependen...

CVE-2026-93214 usb: gadget: f_tcm: fix deadlock in usbg_make_tpg()

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ftcm: fix deadlock in usbgmaketpg usbgmaketpg held deplock while calling configfsdependitemunlocked, which acquires the configfs root inode lock when operating across subsystems. This creates a circular lock dependen...

CVE-2026-93214 usb: gadget: f_tcm: fix deadlock in usbg_make_tpg()

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ftcm: fix deadlock in usbgmaketpg usbgmaketpg held deplock while calling configfsdependitemunlocked, which acquires the configfs root inode lock when operating across subsystems. This creates a circular lock dependen...