CVE-2026-63895 - Vulnerability Details

- usb: gadget: f_fs: copy only received bytes on short ep0 read

Description

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: f_fs: copy only received bytes on short ep0 read

ffs_ep0_read() allocates its control-OUT data buffer with
kmalloc() (not kzalloc) at the Length value from the Setup
packet, then copies that full len to userspace regardless of
how many bytes were actually received:

data = kmalloc(len, GFP_KERNEL);
...
ret = __ffs_ep0_queue_wait(ffs, data, len);
if ((ret > 0) && (copy_to_user(buf, data, len)))
ret = -EFAULT;

__ffs_ep0_queue_wait() returns req->actual, which on a short
control OUT transfer is strictly less than len. The
copy_to_user() call still copies len bytes, so on a short OUT
the last (len - ret) bytes of the kmalloc() buffer --
uninitialised slab residue -- are delivered to the FunctionFS
daemon.

Short ep0 OUT completions are specified USB control-transfer
behavior and are produced by in-tree UDCs:

* dwc2 continues on req->actual < req->length for ep0 DATA OUT
(short-not-ok is the only ep0-OUT stall path).
* aspeed_udc ends ep0 OUT on rx_len < ep->ep.maxpacket.
* renesas_usbf logs "ep0 short packet" and completes the
request.
* dwc3 stalls on short IN but not on short OUT.

A short ep0 OUT is therefore not evidence of a broken UDC; it is
a normal condition f_fs has to cope with. The sibling gadgetfs
implementation in drivers/usb/gadget/legacy/inode.c already does
this correctly via min(len, dev->req->actual) before
copy_to_user(). This patch brings f_fs.c to the same safe
pattern rather than trimming at a defensive layer.

The bug is reached from the FunctionFS device node, which in
real deployments is owned by the privileged gadget daemon
(adbd, UMS, composite gadget services, etc.); it is not
reachable from unprivileged userspace. Linux host stacks
normally reject short-wLength control OUTs before they reach
the gadget, so reproducing this required a build that
bypasses that host-side check. With the bypass in place, a
1-byte payload on a 64-byte Setup produces 63 bytes of
non-canary slab residue in the daemon's read buffer.

Fix by copying only ret (actually received) bytes to
userspace.

Published: 2026-07-19

Score: n/a

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

In the Linux kernel the FunctionFS gadget driver allocates a control‑OUT data buffer of the requested length and copies the full length to userspace, even when the actual transfer is shorter. This causes uninitialized slab residue to be delivered to the userspace gadget daemon, allowing sensitive kernel data to be read. The flaw satisfies CWE‑125 (Unchecked Return Value leading to Overread) and permits information leakage without modifying kernel data or crashing the system.

Affected Systems

All Linux kernel builds that ship the FunctionFS gadget driver are potentially affected. The bug is not tied to a specific vendor release and may appear in any kernel that has not yet incorporated the upstream patch. The vulnerability is accessible only to privileged gadget services such as adbd, UMS, or other composite gadget daemons, and cannot be triggered by unprivileged userspace programs.

Risk and Exploitability

Based on the description, it is inferred that the attack vector involves a privileged gadget daemon performing a short control‑OUT transfer that bypasses host‑side checks. The EPSS score is listed as <1% and the vulnerability is not present in the CISA KEV catalog, indicating a low likelihood of exploitation in the wild. Exploitation requires a privileged gadget daemon and a short control‑OUT transfer with a bypass of the host stack’s length check. While the information exposed can aid further attacks, the attack path is non‑trivial and the overall risk to the majority of deployments is modest until patched.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`ddf8abd2599491cbad959c700b90ba72a5dce8d0`	affected	< 90ccf5fb63243fae1b4b3200f3310500500ecf2e
`ddf8abd2599491cbad959c700b90ba72a5dce8d0`	affected	< af32dbb2ca0b3d09271ab718d13857a457fa16f2
`ddf8abd2599491cbad959c700b90ba72a5dce8d0`	affected	< e835bf9a055f71874065a40780ca5560b7df8b33
`ddf8abd2599491cbad959c700b90ba72a5dce8d0`	affected	< 88874a19b2b093bfaaa1c0090fa536c44da8c08b
`ddf8abd2599491cbad959c700b90ba72a5dce8d0`	affected	< 607730a414773a7cbe3037a64a6c64e72689ff5e
`ddf8abd2599491cbad959c700b90ba72a5dce8d0`	affected	< 23c1f7deb9dd8447ecde749850676302aa1e2bd3
`ddf8abd2599491cbad959c700b90ba72a5dce8d0`	affected	< 4e036c10e7f4df5d951c69cc3697bc8e209c6d02

Linux

affected

Version	Status	Constraints
`2.6.35`	affected	—
`0`	unaffected	< 2.6.35
`5.15.210`	unaffected	≤ 5.15.*
`6.1.176`	unaffected	≤ 6.1.*
`6.6.143`	unaffected	≤ 6.6.*
`6.12.93`	unaffected	≤ 6.12.*
`6.18.35`	unaffected	≤ 6.18.*
`7.0.12`	unaffected	≤ 7.0.*
`7.1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[ddf8abd2599491cbad959c700b90ba72a5dce8d0,90ccf5fb63243fae1b4b3200f3310500500ecf2e)`	affected	code_commit	—
`[ddf8abd2599491cbad959c700b90ba72a5dce8d0,af32dbb2ca0b3d09271ab718d13857a457fa16f2)`	affected	code_commit	—
`[ddf8abd2599491cbad959c700b90ba72a5dce8d0,e835bf9a055f71874065a40780ca5560b7df8b33)`	affected	code_commit	—
`[ddf8abd2599491cbad959c700b90ba72a5dce8d0,88874a19b2b093bfaaa1c0090fa536c44da8c08b)`	affected	code_commit	—
`[ddf8abd2599491cbad959c700b90ba72a5dce8d0,607730a414773a7cbe3037a64a6c64e72689ff5e)`	affected	code_commit	—
`[ddf8abd2599491cbad959c700b90ba72a5dce8d0,23c1f7deb9dd8447ecde749850676302aa1e2bd3)`	affected	code_commit	—
`[ddf8abd2599491cbad959c700b90ba72a5dce8d0,4e036c10e7f4df5d951c69cc3697bc8e209c6d02)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`2.6.35`	affected	semver	—
`[0,2.6.35)`	unaffected	semver	—
`[5.15.210,5.16.0)`	unaffected	semver	—
`[6.1.176,6.2.0)`	unaffected	semver	—
`[6.6.143,6.7.0)`	unaffected	semver	—
`[6.12.93,6.13.0)`	unaffected	semver	—
`[6.18.35,6.19.0)`	unaffected	semver	—
`[7.0.12,7.1.0)`	unaffected	semver	—
`[7.1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply the upstream Linux kernel patch that limits the copied length to the actual number of bytes received in FunctionFS.
Restrict privileged gadget daemons such as adbd, UMS, and composite gadget services to run only when necessary and isolate them from untrusted input sources.
Verify that FunctionFS drivers are disabled or omitted from systems that do not require USB gadget functionality; consider removing unsupported gadget configurations from the kernel build.

Generated by OpenCVE AI on August 4, 2026 at 06:52 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Ubuntu USN	USN-8593-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8603-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8618-1	Linux kernel vulnerabilities

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00244.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/23c1f7deb9dd8447ecde749850676302aa1e2bd3
https://git.kernel.org/stable/c/4e036c10e7f4df5d951c69cc3697bc8e209c6d02
https://git.kernel.org/stable/c/607730a414773a7cbe3037a64a6c64e72689ff5e
https://git.kernel.org/stable/c/88874a19b2b093bfaaa1c0090fa536c44da8c08b
https://git.kernel.org/stable/c/90ccf5fb63243fae1b4b3200f3310500500ecf2e
https://git.kernel.org/stable/c/af32dbb2ca0b3d09271ab718d13857a457fa16f2
https://git.kernel.org/stable/c/e835bf9a055f71874065a40780ca5560b7df8b33
https://lore.kernel.org/linux-cve-announce/2026071942-CVE-2026-63895-bbd1@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-63895
https://www.cve.org/CVERecord?id=CVE-2026-63895

History

Mon, 27 Jul 2026 20:30:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-200

Wed, 22 Jul 2026 19:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-200

Wed, 22 Jul 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-125
References		https://lore.kernel.org/linux-cve-announce/2026071942-CVE-2026-63895-bbd1@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-63895 https://www.cve.org/CVERecord?id=CVE-2026-63895

Sun, 19 Jul 2026 15:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_fs: copy only received bytes on short ep0 read ffs_ep0_read() allocates its control-OUT data buffer with kmalloc() (not kzalloc) at the Length value from the Setup packet, then copies that full len to userspace regardless of how many bytes were actually received: data = kmalloc(len, GFP_KERNEL); ... ret = __ffs_ep0_queue_wait(ffs, data, len); if ((ret > 0) && (copy_to_user(buf, data, len))) ret = -EFAULT; __ffs_ep0_queue_wait() returns req->actual, which on a short control OUT transfer is strictly less than len. The copy_to_user() call still copies len bytes, so on a short OUT the last (len - ret) bytes of the kmalloc() buffer -- uninitialised slab residue -- are delivered to the FunctionFS daemon. Short ep0 OUT completions are specified USB control-transfer behavior and are produced by in-tree UDCs: * dwc2 continues on req->actual < req->length for ep0 DATA OUT (short-not-ok is the only ep0-OUT stall path). * aspeed_udc ends ep0 OUT on rx_len < ep->ep.maxpacket. * renesas_usbf logs "ep0 short packet" and completes the request. * dwc3 stalls on short IN but not on short OUT. A short ep0 OUT is therefore not evidence of a broken UDC; it is a normal condition f_fs has to cope with. The sibling gadgetfs implementation in drivers/usb/gadget/legacy/inode.c already does this correctly via min(len, dev->req->actual) before copy_to_user(). This patch brings f_fs.c to the same safe pattern rather than trimming at a defensive layer. The bug is reached from the FunctionFS device node, which in real deployments is owned by the privileged gadget daemon (adbd, UMS, composite gadget services, etc.); it is not reachable from unprivileged userspace. Linux host stacks normally reject short-wLength control OUTs before they reach the gadget, so reproducing this required a build that bypasses that host-side check. With the bypass in place, a 1-byte payload on a 64-byte Setup produces 63 bytes of non-canary slab residue in the daemon's read buffer. Fix by copying only ret (actually received) bytes to userspace.
Title		usb: gadget: f_fs: copy only received bytes on short ep0 read
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/23c1f7deb9dd8447ecde749850676302aa1e2bd3 https://git.kernel.org/stable/c/4e036c10e7f4df5d951c69cc3697bc8e209c6d02 https://git.kernel.org/stable/c/607730a414773a7cbe3037a64a6c64e72689ff5e https://git.kernel.org/stable/c/88874a19b2b093bfaaa1c0090fa536c44da8c08b https://git.kernel.org/stable/c/90ccf5fb63243fae1b4b3200f3310500500ecf2e https://git.kernel.org/stable/c/af32dbb2ca0b3d09271ab718d13857a457fa16f2 https://git.kernel.org/stable/c/e835bf9a055f71874065a40780ca5560b7df8b33

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-07-19T14:55:05.479Z

Updated: 2026-07-19T14:55:05.479Z

Reserved: 2026-07-19T07:54:57.019Z

Link: CVE-2026-63895

Vulnrichment

No data.

NVD

No data.

Redhat

Severity :

Publid Date: 2026-07-19T00:00:00Z

Links: CVE-2026-63895 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-04T07:00:05Z

Weaknesses

CWE-125
Out-of-bounds Read

Impact

Affected Systems

Risk and Exploitability

Tracking

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object