From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 10218384CED for ; Sat, 25 Jul 2026 08:54:56 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784969698; cv=none; b=n2XB5E/UPjChAjX9aGVn46z2BwsvpV9yDeGicZ6j78WpQ60oJpSwZ0oXfQWu3mLFOYXzd6l+7RRIyyQqObGblcN3Bpw5sAFJ3pGVjUz493bqYamQMUJKpJQpDl04NO7dR4VrYKPTEO9xguLPwit8b8aGPnXytG9sIAFhqvPYTjc= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784969698; c=relaxed/simple; bh=E48WQf9zvYwBabxiO9CDyHvsU5NyFl9WedGnDgIhoS8=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=pw8wVIr+odlqih1jWXqvTMcHXQtW8LzrGKlRLivnmXhxl5EKslU/nuJuZVS2bvzPM/6UCsWFkXX0L8PF0fzN4VZqAZ5w/x8XGuIB3qZC9VFJu31eh+4KwlxslvOWUrgLu5pb3lH8A/IiH6fNOAazU/62/uPIpo7z8MlJGmKhTxk= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=Whiz5rmS; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="Whiz5rmS" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 480051F000E9; Sat, 25 Jul 2026 08:54:55 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1784969695; bh=nIgJqcKu3/c9X2zfkiTs3MiWXqNJn9WtIEgLVsePKtw=; h=From:To:Cc:Subject:Date:Reply-To; b=Whiz5rmSTZLFW8MnYJc5UCecosUjNaNubQWgSJ5UFrPKDWmG4ezrkLv5yOlGAttqc l55ITbEPq8fvQgcRFAJIwsku2sC9F0L2tHHbN2NXYz1HoI/KPQeOXUXZgYGp2CHFce aj+7sbWLtUl9/enjBLgxEOfHDJELm9kzyCPCIpcE= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-64347: usb: gadget: composite: fix dead empty check in the USB_DT_OTG handler Date: Sat, 25 Jul 2026 10:49:24 +0200 Message-ID: <2026072517-CVE-2026-64347-5cc7@gregkh> X-Mailer: git-send-email 2.55.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=4182; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=87NqIKfXJVYFeqZ1tgxh1jgCyi3zHWf05yrufbopR/Y=; b=owGbwMvMwCRo6H6F97bub03G02pJDFkpFYE/3k3ZPW83b3tcTN56sff32RIfTHCvfROV/Fra0 3W6W9qUjlgWBkEmBlkxRZYv23iO7q84pOhlaHsaZg4rE8gQBi5OAZhIbBzD/Mq9jB4yFoa1TCaT 1thMOszFkaRiwzDPNuX5XsarHXrGzOXPJz/eXNMkvFsZAA== X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: usb: gadget: composite: fix dead empty check in the USB_DT_OTG handler The OTG branch of composite_setup() falls back to the first configuration when none is selected: if (cdev->config) config = cdev->config; else config = list_first_entry(&cdev->configs, struct usb_configuration, list); if (!config) goto done; ... memcpy(req->buf, config->descriptors[0], value); list_first_entry() never returns NULL. On an empty list it returns container_of() of the list head. So the "if (!config)" check is dead. When cdev->configs is empty, config points at the head inside struct usb_composite_dev. config->descriptors[0] reads whatever sits at that offset. The memcpy copies up to w_length bytes of it into the response buffer. cdev->configs can be empty in two cases. One is a teardown race on gadget unbind with a control transfer in flight. The other is a driver that sets is_otg before it adds a config. A reproducer that holds cdev->configs empty triggers a KASAN fault in this branch. Use list_first_entry_or_null() so the existing check does its job. The Linux kernel CVE team has assigned CVE-2026-64347 to this issue. Affected and fixed versions =========================== Issue introduced in 4.3 with commit 53e6242db8d60da0587d36951cc9434d1a1c21dd and fixed in 5.10.261 with commit 2454264b2ab4cf0055c0bfd39e79f830452bd0db Issue introduced in 4.3 with commit 53e6242db8d60da0587d36951cc9434d1a1c21dd and fixed in 5.15.212 with commit d3e72cfef2e38bd588055739a8100d14f9773b17 Issue introduced in 4.3 with commit 53e6242db8d60da0587d36951cc9434d1a1c21dd and fixed in 6.1.178 with commit 8ac463fe6c0f85bdb1ce8c30e8c9e060802e4483 Issue introduced in 4.3 with commit 53e6242db8d60da0587d36951cc9434d1a1c21dd and fixed in 6.6.145 with commit 56add2b9b2e89ec61c0761165d758f73004fdfdf Issue introduced in 4.3 with commit 53e6242db8d60da0587d36951cc9434d1a1c21dd and fixed in 6.12.96 with commit 91b3ecd34b60f950c50c560974945b6596a6f207 Issue introduced in 4.3 with commit 53e6242db8d60da0587d36951cc9434d1a1c21dd and fixed in 6.18.39 with commit 01feaf024f29618d5ffa7ab0fd858e0579dcbf7b Issue introduced in 4.3 with commit 53e6242db8d60da0587d36951cc9434d1a1c21dd and fixed in 7.1.4 with commit fcb21bf747640c9d6bd1eda9da85420f076d59c1 Issue introduced in 4.3 with commit 53e6242db8d60da0587d36951cc9434d1a1c21dd and fixed in 7.2-rc3 with commit f8f680609c2b3ab795ffcd6f21585b6dfc46d395 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-64347 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/usb/gadget/composite.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/2454264b2ab4cf0055c0bfd39e79f830452bd0db https://git.kernel.org/stable/c/d3e72cfef2e38bd588055739a8100d14f9773b17 https://git.kernel.org/stable/c/8ac463fe6c0f85bdb1ce8c30e8c9e060802e4483 https://git.kernel.org/stable/c/56add2b9b2e89ec61c0761165d758f73004fdfdf https://git.kernel.org/stable/c/91b3ecd34b60f950c50c560974945b6596a6f207 https://git.kernel.org/stable/c/01feaf024f29618d5ffa7ab0fd858e0579dcbf7b https://git.kernel.org/stable/c/fcb21bf747640c9d6bd1eda9da85420f076d59c1 https://git.kernel.org/stable/c/f8f680609c2b3ab795ffcd6f21585b6dfc46d395