CVE-2026-90023

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: f_mass_storage: fix null pointer dereference in fsg_common_set_num_buffers()

Previously fsg_num_buffers_validate() was removed as it was not

necessary due to Kconfig setting the limits for n from 2 to 256 with

default as 2. However, setting the page content in such a way that

kstrtou8() reflects n value as either 0 or 1 bypasses these

restrictions leading to a null pointer dereference if n is 0. Fix

this by adding a check for n < 2 and returning -EINVAL if n is

either 0 or 1 consistent with Kconfig logic.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References