CVE-2026-63895

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: f_fs: copy only received bytes on short ep0 read

ffs_ep0_read() allocates its control-OUT data buffer with

kmalloc() (not kzalloc) at the Length value from the Setup

packet, then copies that full len to userspace regardless of

how many bytes were actually received:

data = kmalloc(len, GFP_KERNEL);

...

ret = __ffs_ep0_queue_wait(ffs, data, len);

if ((ret > 0) && (copy_to_user(buf, data, len)))

ret = -EFAULT;

__ffs_ep0_queue_wait() returns req->actual, which on a short

control OUT transfer is strictly less than len. The

copy_to_user() call still copies len bytes, so on a short OUT

the last (len - ret) bytes of the kmalloc() buffer --

uninitialised slab residue -- are delivered to the FunctionFS

daemon.

Short ep0 OUT completions are specified USB control-transfer

behavior and are produced by in-tree UDCs:

* dwc2 continues on req->actual < req->length for ep0 DATA OUT

(

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References