CVE-2026-93120usb: gadget: configfs: fix out-of-bounds read of qw_sign
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: configfs: fix out-of-bounds read of qw_sign os_desc_qw_sign_show() passes OS_STRING_QW_SIGN_LEN as the input length to utf16s_to_utf8s(), but that argument counts UTF-16 code units while OS_STRING_QW_SIGN_LEN (14) is the byte size of qw_sign[]. The array holds only OS_STRING_QW_SIGN_LEN / 2 (7) code units, so the conversion reads up to 7 units (14 bytes) past the end of qw_sign[] into the following members of struct gadget_info when the stored signature fills the array without a NUL terminator, exposing those bytes through the configfs attribute. The store path halves the count for its input bound but passes the full byte count as the utf8s_to_utf16s() output limit; use the destination code-unit count in both directions.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Sep 17, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 76180d716f91f035d9c8639497cf5459b44e1a51 before b895dbed8ac9e12a5ffa1a2165575a8469f8340d; 76180d716f91f035d9c8639497cf5459b44e1a51 builds before 9b45125501aad2dff7730970461b455b0e0658ee; from 76180d716f91f035d9c8639497cf5459b44e1a51 before f6da500b0f8106882598b6dec87fe37d653946cf; from 76180d716f91f035d9c8639497cf5459b44e1a51 before a28c486434634f6d1e120711d2b09f3eddea6c98; 76180d716f91f035d9c8639497cf5459b44e1a51 builds before 7e94cb967778e074411940db4db97f22ed77560c; from 76180d716f91f035d9c8639497cf5459b44e1a51 before afbf39c0f2297c6abef6d670a82a2079b0836191; 76180d716f91f035d9c8639497cf5459b44e1a51 builds before 36315a330e067f7773196940552feacb1debbef1; from 76180d716f91f035d9c8639497cf5459b44e1a51 before f63edb54d8f738f9c21e2068c777ae1c097df6b7 | CNA record |
References
- https://git.kernel.org/stable/c/b895dbed8ac9e12a5ffa1a2165575a8469f8340d
- https://git.kernel.org/stable/c/9b45125501aad2dff7730970461b455b0e0658ee
- https://git.kernel.org/stable/c/f6da500b0f8106882598b6dec87fe37d653946cf
- https://git.kernel.org/stable/c/a28c486434634f6d1e120711d2b09f3eddea6c98
- https://git.kernel.org/stable/c/7e94cb967778e074411940db4db97f22ed77560c
- https://git.kernel.org/stable/c/afbf39c0f2297c6abef6d670a82a2079b0836191
- https://git.kernel.org/stable/c/36315a330e067f7773196940552feacb1debbef1
- https://git.kernel.org/stable/c/f63edb54d8f738f9c21e2068c777ae1c097df6b7
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.