CVE-2026-64327
Received Received - Intake

USB Gadget FunctionFS Endpoint Direction Check Bypass

Publication date: 2026-07-25

Last updated on: 2026-07-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_fs: Initialize epfile->in early to fix endpoint direction checks When parsing endpoint descriptors, ffs_data_got_descs() generates the eps_addrmap which contains the endpoint direction. However, epfile->in was previously only populated in ffs_func_eps_enable() which executes upon USB host connection. As a result, early userspace ioctls like FUNCTIONFS_DMABUF_ATTACH that run before the host connects would see epfile->in as 0, leading to incorrect DMA directions. By moving the initialization to ffs_epfiles_create(), epfile->in is accurate before userspace opens the endpoint files.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-25
Last Modified
2026-07-25
Generated
2026-07-25
AI Q&A
2026-07-25
EPSS Evaluated
N/A
NVD
CVE-2026-64327
EUVD
EUVD-2026-48871

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves incorrect endpoint direction checks in the USB gadget function filesystem (f_fs). The issue occurs because epfile->in, which indicates endpoint direction, is initialized too late. This causes early userspace operations like FUNCTIONFS_DMABUF_ATTACH to see incorrect direction values before the USB host connects.

Detection Guidance

This vulnerability is specific to the Linux kernel's USB gadget function filesystem (f_fs). Detection requires checking the kernel version and whether the vulnerable code path exists. Use uname -a to check the kernel version and grep for the affected function in the kernel source or running kernel.

Impact Analysis

This vulnerability could lead to incorrect DMA direction handling during early USB operations. This might cause data corruption, crashes, or unexpected behavior in systems using USB gadget functionality before host connection.

Mitigation Strategies

Apply the latest kernel update provided by your distribution to patch the vulnerability. If an update is not available, consider disabling the USB gadget function filesystem module (config_usb_functionfs) if not needed. Monitor vendor advisories for kernel fixes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64327. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart