CVE-2026-93120

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: configfs: fix out-of-bounds read of qw_sign

os_desc_qw_sign_show() passes OS_STRING_QW_SIGN_LEN as the input

length to utf16s_to_utf8s(), but that argument counts UTF-16 code

units while OS_STRING_QW_SIGN_LEN (14) is the byte size of qw_sign[].

The array holds only OS_STRING_QW_SIGN_LEN / 2 (7) code units, so the

conversion reads up to 7 units (14 bytes) past the end of qw_sign[]

into the following members of struct gadget_info when the stored

signature fills the array without a NUL terminator, exposing those

bytes through the configfs attribute.

The store path halves the count for its input bound but passes the

full byte count as the utf8s_to_utf16s() output limit; use the

destination code-unit count in both directions.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References