CVE-2026-93120

What it actually does

Out-of-bounds read in os_desc_qw_sign_show and related store path where utf16s_to_utf8s/utf8s_to_utf16s are passed byte counts instead of UTF-16 code-unit counts for the 7-element qw_sign array, allowing reads up to 14 bytes into adjacent struct gadget_info members when the signature lacks a NUL terminator.

Why it matters to the business

Kernel memory contents adjacent to the gadget signature can be exposed through a configfs attribute, potentially leaking internal kernel data that could aid further attacks on systems using USB gadget mode; low immediate risk but requires kernel update on affected devices.

How an attack unfolds

An attacker with access to the configfs USB gadget configuration creates or modifies an OS descriptor, stores a 14-byte signature without NUL terminator, then reads the qw_sign attribute; the conversion function reads past the array end into following structure fields and returns those bytes to user space.

How to fix it

Apply the upstream kernel patch that corrects both the input length passed to utf16s_to_utf8s and the output limit passed to utf8s_to_utf16s so that code-unit counts are used consistently; rebuild and deploy updated kernel images for all affected systems using USB gadget/configfs.

How to confirm the fix worked

Confirm the patched kernel source contains the corrected length calculations using destination array size in code units for both directions; test by storing a maximum-length non-NUL-terminated signature and verifying the show path returns only the expected 7 code units without adjacent memory content.

Typical attack path

1. Mount or access configfs USB gadget hierarchy
2. Create or select an OS descriptor entry
3. Write a full 14-byte signature value without trailing NUL via the store path
4. Read the qw_sign attribute to trigger the show path and obtain leaked bytes
5. Parse returned data for sensitive kernel memory contents

How to detect it

Examine kernel logs and configfs access traces for repeated reads of the OS descriptor qw_sign attribute after writes of maximum-length signatures; look for unexpected data patterns or memory disclosure artifacts in gadget configuration operations.

What your security team should do

• Prioritize kernel updates on any systems exposing USB gadget functionality via configfs
• Audit devices that rely on USB gadget mode for OS descriptor handling
• Monitor upstream stable kernel releases for the merged fix
• Restrict configfs access to trusted processes until patched kernels are deployed