CVE-2026-64327 - Vulnerability Details

- usb: gadget: f_fs: Initialize epfile->in early to fix endpoint direction checks

Description

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: f_fs: Initialize epfile->in early to fix endpoint direction checks

When parsing endpoint descriptors, ffs_data_got_descs() generates the
eps_addrmap which contains the endpoint direction. However, epfile->in
was previously only populated in ffs_func_eps_enable() which executes
upon USB host connection. As a result, early userspace ioctls like
FUNCTIONFS_DMABUF_ATTACH that run before the host connects would see
epfile->in as 0, leading to incorrect DMA directions.

By moving the initialization to ffs_epfiles_create(), epfile->in is
accurate before userspace opens the endpoint files.

Published: 2026-07-25

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The Linux kernel FunctionFS driver incorrectly initializes the endpoint direction field, causing early userspace ioctl requests to see a zero value until the USB host connects. This leads to incorrect DMA direction handling for operations such as FUNCTIONFS_DMABUF_ATTACH, which can result in unintended data transfers or memory corruption.

Affected Systems

Linux kernels prior to the patch that implements early epfile->in initialization. Any distribution shipping a kernel with the FunctionFS driver without this change is affected. The affected product is the Linux kernel, all vendors that ship it unchanged.

Risk and Exploitability

The CVSS score is 5.5, indicating moderate severity, while the EPSS score of <1% implies a low likelihood of exploitation. The vulnerability is not listed in CISA KEV. Externally, it requires a local user to invoke early ioctl operations before a host connects, so it is a local privilege scenario. The likely attack vector is local use of FUNCTIONFS_DMABUF_ATTACH before the USB device is attached, which could misdirect DMA transfers.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`7b07a2a7ca02a20124b552be96c5a56910795488`	affected	< 82cf1142e5ccf2b6d6d22ef713aaf3e5f2b5716b
`7b07a2a7ca02a20124b552be96c5a56910795488`	affected	< 9e04055ab5fc0470a0031ee6934739f9aa8f34a5
`7b07a2a7ca02a20124b552be96c5a56910795488`	affected	< f99f32ea9aa976afcbec20647ed33b50a52002c1
`7b07a2a7ca02a20124b552be96c5a56910795488`	affected	< 82cfd4739011bdc7e87b5d585703427e89ddfaa5

Linux

affected

Version	Status	Constraints
`6.9`	affected	—
`0`	unaffected	< 6.9
`6.12.96`	unaffected	≤ 6.12.*
`6.18.39`	unaffected	≤ 6.18.*
`7.1.4`	unaffected	≤ 7.1.*
`7.2-rc3`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[7b07a2a7ca02a20124b552be96c5a56910795488,82cf1142e5ccf2b6d6d22ef713aaf3e5f2b5716b)`	affected	code_commit	—
`[7b07a2a7ca02a20124b552be96c5a56910795488,9e04055ab5fc0470a0031ee6934739f9aa8f34a5)`	affected	code_commit	—
`[7b07a2a7ca02a20124b552be96c5a56910795488,f99f32ea9aa976afcbec20647ed33b50a52002c1)`	affected	code_commit	—
`[7b07a2a7ca02a20124b552be96c5a56910795488,82cfd4739011bdc7e87b5d585703427e89ddfaa5)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`6.9`	affected	generic	—
`[0,6.9)`	unaffected	generic	—
`[6.12.96,6.12.*]`	unaffected	generic	—
`[6.18.39,6.18.*]`	unaffected	generic	—
`[7.1.4,7.1.*]`	unaffected	generic	—
`[7.2-rc3,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Update the Linux kernel to a version that includes the epfile->in early initialization patch.
If an immediate kernel upgrade is not possible, delay all early FUNCTIONFS_DMABUF_ATTACH calls until after the USB device is connected to a host.
Where feasible, configure devices to not expose DMA attachment capabilities before host connection and monitor system logs for DMA direction warnings.

Generated by OpenCVE AI on August 3, 2026 at 19:13 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4724-1	linux-6.12 new package

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.002.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/82cf1142e5ccf2b6d6d22ef713aaf3e5f2b5716b
https://git.kernel.org/stable/c/82cfd4739011bdc7e87b5d585703427e89ddfaa5
https://git.kernel.org/stable/c/9e04055ab5fc0470a0031ee6934739f9aa8f34a5
https://git.kernel.org/stable/c/f99f32ea9aa976afcbec20647ed33b50a52002c1
https://lore.kernel.org/linux-cve-announce/2026072512-CVE-2026-64327-fb4d@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-64327
https://www.cve.org/CVERecord?id=CVE-2026-64327

History

Thu, 30 Jul 2026 12:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-908
References		https://lore.kernel.org/linux-cve-announce/2026072512-CVE-2026-64327-fb4d@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-64327 https://www.cve.org/CVERecord?id=CVE-2026-64327
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Thu, 30 Jul 2026 04:15:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-20 CWE-754

Mon, 27 Jul 2026 06:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-20 CWE-754

Sat, 25 Jul 2026 09:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_fs: Initialize epfile->in early to fix endpoint direction checks When parsing endpoint descriptors, ffs_data_got_descs() generates the eps_addrmap which contains the endpoint direction. However, epfile->in was previously only populated in ffs_func_eps_enable() which executes upon USB host connection. As a result, early userspace ioctls like FUNCTIONFS_DMABUF_ATTACH that run before the host connects would see epfile->in as 0, leading to incorrect DMA directions. By moving the initialization to ffs_epfiles_create(), epfile->in is accurate before userspace opens the endpoint files.
Title		usb: gadget: f_fs: Initialize epfile->in early to fix endpoint direction checks
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/82cf1142e5ccf2b6d6d22ef713aaf3e5f2b5716b https://git.kernel.org/stable/c/82cfd4739011bdc7e87b5d585703427e89ddfaa5 https://git.kernel.org/stable/c/9e04055ab5fc0470a0031ee6934739f9aa8f34a5 https://git.kernel.org/stable/c/f99f32ea9aa976afcbec20647ed33b50a52002c1

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-07-25T08:49:55.426Z

Updated: 2026-07-25T08:49:55.426Z

Reserved: 2026-07-19T15:36:31.780Z

Link: CVE-2026-64327

Vulnrichment

No data.

NVD

Status : Awaiting Analysis

Published: 2026-07-25T10:17:14.327

Modified: 2026-08-11T15:00:57.447

Link: CVE-2026-64327

Redhat

Severity : Moderate

Publid Date: 2026-07-25T00:00:00Z

Links: CVE-2026-64327 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-03T19:15:04Z

Weaknesses

CWE-908
Use of Uninitialized Resource

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object