CVE-2026-64347: usb: gadget: composite: fix dead empty check in the USB_DT_OTG handler

CVE-2026-64347: usb: gadget: composite: fix dead empty check in the USB_DT_OTG handler

[Greg Kroah-Hartman]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: composite: fix dead empty check in the USB_DT_OTG handler

The OTG branch of composite_setup() falls back to the first
configuration when none is selected:

	if (cdev->config)
		config = cdev->config;
	else
		config = list_first_entry(&cdev->configs,
					  struct usb_configuration, list);
	if (!config)
		goto done;
	...
	memcpy(req->buf, config->descriptors[0], value);

list_first_entry() never returns NULL. On an empty list it returns
container_of() of the list head. So the "if (!config)" check is dead.

When cdev->configs is empty, config points at the head inside struct
usb_composite_dev. config->descriptors[0] reads whatever sits at that
offset. The memcpy copies up to w_length bytes of it into the response
buffer.

cdev->configs can be empty in two cases. One is a teardown race on
gadget unbind with a control transfer in flight. The other is a driver
that sets is_otg before it adds a config. A reproducer that holds
cdev->configs empty triggers a KASAN fault in this branch.

Use list_first_entry_or_null() so the existing check does its job.

The Linux kernel CVE team has assigned CVE-2026-64347 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 4.3 with commit 53e6242db8d60da0587d36951cc9434d1a1c21dd and fixed in 5.10.261 with commit 2454264b2ab4cf0055c0bfd39e79f830452bd0db
	Issue introduced in 4.3 with commit 53e6242db8d60da0587d36951cc9434d1a1c21dd and fixed in 5.15.212 with commit d3e72cfef2e38bd588055739a8100d14f9773b17
	Issue introduced in 4.3 with commit 53e6242db8d60da0587d36951cc9434d1a1c21dd and fixed in 6.1.178 with commit 8ac463fe6c0f85bdb1ce8c30e8c9e060802e4483
	Issue introduced in 4.3 with commit 53e6242db8d60da0587d36951cc9434d1a1c21dd and fixed in 6.6.145 with commit 56add2b9b2e89ec61c0761165d758f73004fdfdf
	Issue introduced in 4.3 with commit 53e6242db8d60da0587d36951cc9434d1a1c21dd and fixed in 6.12.96 with commit 91b3ecd34b60f950c50c560974945b6596a6f207
	Issue introduced in 4.3 with commit 53e6242db8d60da0587d36951cc9434d1a1c21dd and fixed in 6.18.39 with commit 01feaf024f29618d5ffa7ab0fd858e0579dcbf7b
	Issue introduced in 4.3 with commit 53e6242db8d60da0587d36951cc9434d1a1c21dd and fixed in 7.1.4 with commit fcb21bf747640c9d6bd1eda9da85420f076d59c1
	Issue introduced in 4.3 with commit 53e6242db8d60da0587d36951cc9434d1a1c21dd and fixed in 7.2-rc3 with commit f8f680609c2b3ab795ffcd6f21585b6dfc46d395

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-64347
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/usb/gadget/composite.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/2454264b2ab4cf0055c0bfd39e79f830452bd0db
	https://git.kernel.org/stable/c/d3e72cfef2e38bd588055739a8100d14f9773b17
	https://git.kernel.org/stable/c/8ac463fe6c0f85bdb1ce8c30e8c9e060802e4483
	https://git.kernel.org/stable/c/56add2b9b2e89ec61c0761165d758f73004fdfdf
	https://git.kernel.org/stable/c/91b3ecd34b60f950c50c560974945b6596a6f207
	https://git.kernel.org/stable/c/01feaf024f29618d5ffa7ab0fd858e0579dcbf7b
	https://git.kernel.org/stable/c/fcb21bf747640c9d6bd1eda9da85420f076d59c1
	https://git.kernel.org/stable/c/f8f680609c2b3ab795ffcd6f21585b6dfc46d395