CVE-2026-64347

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: composite: fix dead empty check in the USB_DT_OTG handler

The OTG branch of composite_setup() falls back to the first

configuration when none is selected:

if (cdev->config)

config = cdev->config;

else

config = list_first_entry(&cdev->configs,

struct usb_configuration, list);

if (!config)

goto done;

...

memcpy(req->buf, config->descriptors[0], value);

list_first_entry() never returns NULL. On an empty list it returns

container_of() of the list head. So the "if (!config)" check is dead.

When cdev->configs is empty, config points at the head inside struct

usb_composite_dev. config->descriptors[0] reads whatever sits at that

offset. The memcpy copies up to w_length bytes of it into the response

buffer.

cdev->configs can be empty in two cases. One is a teardown race on

gadget unbind with a control transfer in flight. The other is a driver

that sets is_otg before it adds a config. A repro

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References