CVE-2026-64327 - Vulnerability Details

- usb: gadget: f_fs: Initialize epfile->in early to fix endpoint direction checks

Description

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: f_fs: Initialize epfile->in early to fix endpoint direction checks

When parsing endpoint descriptors, ffs_data_got_descs() generates the
eps_addrmap which contains the endpoint direction. However, epfile->in
was previously only populated in ffs_func_eps_enable() which executes
upon USB host connection. As a result, early userspace ioctls like
FUNCTIONFS_DMABUF_ATTACH that run before the host connects would see
epfile->in as 0, leading to incorrect DMA directions.

By moving the initialization to ffs_epfiles_create(), epfile->in is
accurate before userspace opens the endpoint files.

Published: 2026-07-25

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The Linux kernel FunctionFS driver improperly initializes the epfile->in field, causing early userspace ioctl calls such as FUNCTIONFS_DMABUF_ATTACH to see an incorrect DMA direction until the USB host is connected; this misdirection can lead the kernel to perform DMA transfers with the wrong source or destination, potentially leaking sensitive memory or causing data corruption.

Affected Systems

Linux kernel versions prior to the patch that initializes epfile->in early are affected; any distribution shipping an unpatched kernel with the FunctionFS driver, especially kernels before the 7.2 release that lacked this change, is vulnerable, and the issue manifests in the FunctionFS device nodes exposed by the USB gadget subsystem.

Risk and Exploitability

The CVSS score of 5.5 indicates moderate severity, while an EPSS score of less than 1% shows a low likelihood of exploitation; the vulnerability is not listed in CISA KEV. Exploitation requires a local user to invoke early ioctl operations before a USB host is attached, making it a local privilege scenario that could misdirect DMA transfers and potentially expose sensitive memory or destabilize the system.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`7b07a2a7ca02a20124b552be96c5a56910795488`	affected	< 82cf1142e5ccf2b6d6d22ef713aaf3e5f2b5716b
`7b07a2a7ca02a20124b552be96c5a56910795488`	affected	< 9e04055ab5fc0470a0031ee6934739f9aa8f34a5
`7b07a2a7ca02a20124b552be96c5a56910795488`	affected	< f99f32ea9aa976afcbec20647ed33b50a52002c1
`7b07a2a7ca02a20124b552be96c5a56910795488`	affected	< 82cfd4739011bdc7e87b5d585703427e89ddfaa5

Linux

affected

Version	Status	Constraints
`6.9`	affected	—
`0`	unaffected	< 6.9
`6.12.96`	unaffected	≤ 6.12.*
`6.18.39`	unaffected	≤ 6.18.*
`7.1.4`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel:7.2:rc1::::::
	cpe:2.3:o:linux:linux_kernel:7.2:rc2::::::

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[7b07a2a7ca02a20124b552be96c5a56910795488,82cf1142e5ccf2b6d6d22ef713aaf3e5f2b5716b)`	affected	code_commit	—
`[7b07a2a7ca02a20124b552be96c5a56910795488,9e04055ab5fc0470a0031ee6934739f9aa8f34a5)`	affected	code_commit	—
`[7b07a2a7ca02a20124b552be96c5a56910795488,f99f32ea9aa976afcbec20647ed33b50a52002c1)`	affected	code_commit	—
`[7b07a2a7ca02a20124b552be96c5a56910795488,82cfd4739011bdc7e87b5d585703427e89ddfaa5)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`6.9`	affected	generic	—
`[0,6.9)`	unaffected	generic	—
`[6.12.96,6.12.*]`	unaffected	generic	—
`[6.18.39,6.18.*]`	unaffected	generic	—
`[7.1.4,7.1.*]`	unaffected	generic	—
`[7.2-rc3,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Update the Linux kernel to a version that includes the early epfile->in initialization patch.
If a kernel upgrade is not possible, avoid performing early FUNCTIONFS_DMABUF_ATTACH operations until after a USB host is attached.
If early attachment is mandatory, restrict access to the FUNCTIONFS_DMABUF_ATTACH ioctl through device permissions or by disabling DMA attachment capability.

Generated by OpenCVE AI on September 4, 2026 at 23:47 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4724-1	linux-6.12 new package

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00206.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/82cf1142e5ccf2b6d6d22ef713aaf3e5f2b5716b
https://git.kernel.org/stable/c/82cfd4739011bdc7e87b5d585703427e89ddfaa5
https://git.kernel.org/stable/c/9e04055ab5fc0470a0031ee6934739f9aa8f34a5
https://git.kernel.org/stable/c/f99f32ea9aa976afcbec20647ed33b50a52002c1
https://lore.kernel.org/linux-cve-announce/2026072512-CVE-2026-64327-fb4d@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-64327
https://www.cve.org/CVERecord?id=CVE-2026-64327

History

Fri, 04 Sep 2026 15:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		NVD-CWE-noinfo
CPEs		cpe:2.3:o:linux:linux_kernel:7.2:rc1:::::: cpe:2.3:o:linux:linux_kernel:7.2:rc2::::::

Thu, 30 Jul 2026 12:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-908
References		https://lore.kernel.org/linux-cve-announce/2026072512-CVE-2026-64327-fb4d@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-64327 https://www.cve.org/CVERecord?id=CVE-2026-64327
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Thu, 30 Jul 2026 04:15:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-20 CWE-754

Mon, 27 Jul 2026 06:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-20 CWE-754

Sat, 25 Jul 2026 09:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_fs: Initialize epfile->in early to fix endpoint direction checks When parsing endpoint descriptors, ffs_data_got_descs() generates the eps_addrmap which contains the endpoint direction. However, epfile->in was previously only populated in ffs_func_eps_enable() which executes upon USB host connection. As a result, early userspace ioctls like FUNCTIONFS_DMABUF_ATTACH that run before the host connects would see epfile->in as 0, leading to incorrect DMA directions. By moving the initialization to ffs_epfiles_create(), epfile->in is accurate before userspace opens the endpoint files.
Title		usb: gadget: f_fs: Initialize epfile->in early to fix endpoint direction checks
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/82cf1142e5ccf2b6d6d22ef713aaf3e5f2b5716b https://git.kernel.org/stable/c/82cfd4739011bdc7e87b5d585703427e89ddfaa5 https://git.kernel.org/stable/c/9e04055ab5fc0470a0031ee6934739f9aa8f34a5 https://git.kernel.org/stable/c/f99f32ea9aa976afcbec20647ed33b50a52002c1

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-07-25T08:49:55.426Z

Updated: 2026-08-17T04:53:29.409Z

Reserved: 2026-07-19T15:36:31.780Z

Link: CVE-2026-64327

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2026-07-25T10:17:14.327

Modified: 2026-09-04T14:50:56.703

Link: CVE-2026-64327

Redhat

Severity : Moderate

Publid Date: 2026-07-25T00:00:00Z

Links: CVE-2026-64327 - Bugzilla

OpenCVE Enrichment

Updated: 2026-09-05T00:00:07Z

Weaknesses

CWE-908
Use of Uninitialized Resource
NVD-CWE-noinfo

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object