EUVD-2026-82228

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: configfs: fix out-of-bounds read of qwsign osdescqwsignshow passes OSSTRINGQWSIGNLEN as the input length to utf16stoutf8s, but that argument counts UTF-16 code units while OSSTRINGQWSIGNLEN 14 is the byte size of...

CVE-2026-93120

CVE-2026-93120 affects the Linux kernel 's USB gadget configfs subsystem. The function os_desc_qw_sign_show() passes OS_STRING_QW_SIGN_LEN (a byte count of 14) as the input length to utf16s_to_utf8s(), which expects a count of UTF-16 code units. Since the qw_sign[] array holds only 7 code units (...

EUVD-2026-82101

In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Validate string descriptors The string descriptor length includes a two-byte header while the UTF-16 payload starts after it. utf16stoutf8s expects a count of UTF-16 code units, not bytes. Passing the payload byt...