Cloudanix VulnDB

CVE-2026-98764

None

CVSS

—

EPSS

0.2%

Published

Oct 18, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in the Linux kernel's USB gadget handling can crash the entire system when certain USB setup tools are used at high speeds.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Low
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

NULL pointer dereference panic in f_fs gadget driver when FUNCTIONFS_ENDPOINT_DESC ioctl selects a speed-specific descriptor that was never supplied by userspace, after config_ep_by_speed performed a fallback to lower-speed descriptors.

Why it matters to the business

Unexpected kernel panic and system reboot on Linux devices exposing USB gadget interfaces via FunctionFS, causing loss of USB functionality and any dependent services until manual recovery.

How an attack unfolds

An attacker with local access configures a FunctionFS instance supplying only full-speed descriptors, forces the gadget into high-speed or super-speed operation, then issues the FUNCTIONFS_ENDPOINT_DESC ioctl; the mismatched descriptor index selection dereferences a NULL entry in ep->descs[].

How to fix it

Apply the upstream fix that adds descriptor fallback logic matching config_ep_by_speed and returns -EINVAL when no descriptor exists; rebuild and deploy the patched kernel.

How to confirm the fix worked

Confirm kernel contains the f_fs fallback change; reproduce the only-FS-descriptors scenario at high speed and verify ioctl succeeds or returns a safe error instead of panicking.

Typical attack path

  1. Create FunctionFS instance with FUNCTIONFS_HAS_FS_DESC only
  2. Attach gadget and operate at USB_SPEED_HIGH or higher
  3. Call FUNCTIONFS_ENDPOINT_DESC ioctl on an enabled endpoint
  4. Trigger kernel NULL dereference and panic

How to detect it

Search kernel logs for oops or panic messages containing ffs_epfile_ioctl, FUNCTIONFS_ENDPOINT_DESC, or usb_ep_enable followed by NULL dereference; correlate with gadget attach events at non-full-speed.

  • ffs_epfile_ioctl
  • FUNCTIONFS_ENDPOINT_DESC
  • config_ep_by_speed.*fallback
  • epfile->ep->descs

What your security team should do

  • Prioritize kernel update on all systems exposing USB gadget/FunctionFS interfaces
  • Audit custom gadget userspace code for partial descriptor sets
  • Monitor for kernel oops involving ffs_epfile_ioctl within 30 days

The record

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_fs: Fix NULL pointer dereference in FUNCTIONFS_ENDPOINT_DESC When user space sets up FunctionFS with only full-speed descriptors (e.g., flags = FUNCTIONFS_HAS_FS_DESC) and the gadget operates at a higher speed (such as USB_SPEED_HIGH or USB_SPEED_SUPER), config_ep_by_speed() detects that the function lacks descriptors for the current speed, logs a warning, and falls back to full-speed descriptors. The endpoint is then successfully enabled via usb_ep_enable(), and epfile->ep becomes valid. However, when user space subsequently issues the FUNCTIONFS_ENDPOINT_DESC ioctl to query the endpoint descriptor, ffs_epfile_ioctl() selects the descriptor index solely based on gadget->speed: switch (epfile->ffs->gadget->speed) { case USB_SPEED_SUPER: case USB_SPEED_SUPER_PLUS: desc_idx = 2; break; case USB_SPEED_HIGH: desc_idx = 1; break; default: desc_idx = 0; } desc = epfile->ep->descs[desc_idx]; memcpy(&desc1, desc, desc->bLength); Because user space only supplied full-speed descriptors, epfile->ep->descs[1] is NULL. Dereferencing desc->bLength triggers an immediate kernel NULL pointer dereference panic. Fix this by falling back through lower speed descriptors if the current speed descriptor was not supplied, matching the fallback logic in config_ep_by_speed() and historical f_fs behavior. If still missing, fall back to epfile->ep->ep->desc (the active descriptor), and return -EINVAL safely if no valid descriptor is found. In addition, mark desc as const to match struct usb_ep::desc and avoid discarding qualifiers.

Affected packages

Ecosystem Package Introduced Fixed