CVE-2026-64347

A flaw was found in the USB gadget composite driver in the Linux kernel. An issue with an empty check in the USB_DT_OTG handler can lead to reading from an invalid memory location. This can result in a kernel AddressSanitizer (KASAN) fault, potentially causing information disclosure or a denial of service.

The USB gadget composite USB_DT_OTG handler can use list_first_entry() on an empty cdev configs list and treat the list head as a usb_configuration object. This makes config descriptors point to unrelated kernel memory and can lead to an invalid read during memcpy into the USB control response buffer. A malicious USB host can trigger the vulnerable path when the gadget has no active configurations, for example during a teardown race or during an invalid gadget driver initialization window. For the CVSS the PR:N is used because the attacker does not need credentials on the gadget device, only access to the USB host side of the connection. The issue is not network reachable and requires physical or USB bus access. Impact is at least denial of service via kernel crash, with a plausible confidentiality impact because bytes copied from an unintended kernel address may be returned in the USB response.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.