Cloudanix VulnDB

CVE-2026-93056

None

CVSS

—

EPSS

0.2%

Published

Sep 17, 2026

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A coding mistake in the Linux kernel's USB audio gadget setup could cause crashes when certain configuration options are changed, though the affected options were never actually used.

Exploitation
Local Privilege
Attacker needs
High Privilege
Complexity
Theoretical
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Patch
Effort
Low
Patch risk
Low

What it actually does

Inverted null check after kstrndup in configfs store handlers for legacy UAC1 string attributes causes -ENOMEM return on successful allocation and NULL pointer dereference on allocation failure, resulting in kernel memory corruption.

Why it matters to the business

Potential kernel crashes or instability on systems exposing legacy USB audio gadget configfs interfaces, though the affected attributes have been unused for years and internal defaults remain functional; low operational risk but requires kernel update for full remediation.

How an attack unfolds

An attacker with local access to the configfs filesystem writes to one of the three broken string attributes (fn_play, fn_cap, fn_cntl). The store handler's inverted check either incorrectly fails or dereferences NULL, triggering a kernel panic or memory error. No known threat actors or ransomware campaigns have exploited this issue.

How to fix it

Update to a Linux kernel version that removes the UAC1_STR_ATTRIBUTE macro and its three generated attributes. Rebuild and deploy the kernel; no configuration changes are required as internal defaults continue to apply.

How to confirm the fix worked

Confirm the vulnerable macro and attributes are absent from f_uac1_legacy.c after the update. Attempting writes to the removed attributes should now return standard configfs errors rather than the inverted behavior.

Typical attack path

  1. Obtain local access to a system exposing USB gadget configfs
  2. Locate the broken UAC1 legacy string attributes under the gadget configuration
  3. Issue a write to any of the fn_play, fn_cap, or fn_cntl attributes
  4. Trigger the inverted null check leading to NULL dereference or erroneous error return
  5. Cause kernel oops, panic, or memory corruption

How to detect it

Search kernel logs for oops or panic messages referencing f_uac1_legacy or UAC1_STR_ATTRIBUTE around the time of configfs writes. No widespread exploitation has been observed.

What your security team should do

  • Prioritize kernel updates in environments using USB gadget functionality
  • Monitor kernel logs for NULL dereference oops related to f_uac1_legacy
  • Review any custom USB audio gadget configurations for use of the legacy attributes

The record

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_uac1_legacy: remove broken string configfs attributes The UAC1_STR_ATTRIBUTE macro defines configfs show/store handlers for the fn_play, fn_cap, and fn_cntl string options. The store function contains an inverted null check on the kstrndup() return value. This means every write attempt returns -ENOMEM on success and dereferences a NULL pointer on allocation failure. The attributes have been broken and unused for many years. Remove the UAC1_STR_ATTRIBUTE macro and the three attributes it generated. The internal defaults (FILE_PCM_PLAYBACK, FILE_PCM_CAPTURE, FILE_CONTROL) set in f_audio_alloc_inst() are unaffected.

Affected packages

Ecosystem Package Introduced Fixed