CVE-2026-63895

A flaw was found in the Linux kernel's FunctionFS (f_fs) driver. This vulnerability allows a privileged gadget daemon to receive uninitialized kernel memory (slab residue) due to incorrect handling of short USB control-OUT transfers. When ffs_ep0_read() processes a short control-OUT transfer, it copies more data than was actually received, exposing potentially sensitive information from the kernel's memory to the daemon. This information disclosure could lead to further exploitation.