CVE-2026-64347
Analyzed
Analyzed - Analysis Complete
USB Gadget Composite Dead Code in OTG Handler
Vulnerability report for CVE-2026-64347, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-07-25
Last updated on: 2026-09-03
Assigner: kernel.org
Description
Description
In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: composite: fix dead empty check in the USB_DT_OTG handler
The OTG branch of composite_setup() falls back to the first
configuration when none is selected:
if (cdev->config)
config = cdev->config;
else
config = list_first_entry(&cdev->configs,
struct usb_configuration, list);
if (!config)
goto done;
...
memcpy(req->buf, config->descriptors[0], value);
list_first_entry() never returns NULL. On an empty list it returns
container_of() of the list head. So the "if (!config)" check is dead.
When cdev->configs is empty, config points at the head inside struct
usb_composite_dev. config->descriptors[0] reads whatever sits at that
offset. The memcpy copies up to w_length bytes of it into the response
buffer.
cdev->configs can be empty in two cases. One is a teardown race on
gadget unbind with a control transfer in flight. The other is a driver
that sets is_otg before it adds a config. A reproducer that holds
cdev->configs empty triggers a KASAN fault in this branch.
Use list_first_entry_or_null() so the existing check does its job.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | From 5.11 (inc) to 5.15.212 (exc) |
| linux | linux_kernel | From 5.16 (inc) to 6.1.178 (exc) |
| linux | linux_kernel | From 6.2 (inc) to 6.6.145 (exc) |
| linux | linux_kernel | From 6.7 (inc) to 6.12.96 (exc) |
| linux | linux_kernel | From 6.13 (inc) to 6.18.39 (exc) |
| linux | linux_kernel | From 6.19 (inc) to 7.1.4 (exc) |
| linux | linux_kernel | 7.2 |
| linux | linux_kernel | 7.2 |
| linux | linux_kernel | From 4.3 (inc) to 5.10.261 (exc) |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-667 | The product does not properly acquire or release a lock on a resource, leading to unexpected resource state changes and behaviors. |
