CVE-2026-63895

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> usb: gadget: f_fs: copy only received bytes on short ep0 read<br /> <br /> ffs_ep0_read() allocates its control-OUT data buffer with<br /> kmalloc() (not kzalloc) at the Length value from the Setup<br /> packet, then copies that full len to userspace regardless of<br /> how many bytes were actually received:<br /> <br /> data = kmalloc(len, GFP_KERNEL);<br /> ...<br /> ret = __ffs_ep0_queue_wait(ffs, data, len);<br /> if ((ret &gt; 0) &amp;&amp; (copy_to_user(buf, data, len)))<br /> ret = -EFAULT;<br /> <br /> __ffs_ep0_queue_wait() returns req-&gt;actual, which on a short<br /> control OUT transfer is strictly less than len. The<br /> copy_to_user() call still copies len bytes, so on a short OUT<br /> the last (len - ret) bytes of the kmalloc() buffer --<br /> uninitialised slab residue -- are delivered to the FunctionFS<br /> daemon.<br /> <br /> Short ep0 OUT completions are specified USB control-transfer<br /> behavior and are produced by in-tree UDCs:<br /> <br /> * dwc2 continues on req-&gt;actual length for ep0 DATA OUT<br /> (short-not-ok is the only ep0-OUT stall path).<br /> * aspeed_udc ends ep0 OUT on rx_len ep.maxpacket.<br /> * renesas_usbf logs "ep0 short packet" and completes the<br /> request.<br /> * dwc3 stalls on short IN but not on short OUT.<br /> <br /> A short ep0 OUT is therefore not evidence of a broken UDC; it is<br /> a normal condition f_fs has to cope with. The sibling gadgetfs<br /> implementation in drivers/usb/gadget/legacy/inode.c already does<br /> this correctly via min(len, dev-&gt;req-&gt;actual) before<br /> copy_to_user(). This patch brings f_fs.c to the same safe<br /> pattern rather than trimming at a defensive layer.<br /> <br /> The bug is reached from the FunctionFS device node, which in<br /> real deployments is owned by the privileged gadget daemon<br /> (adbd, UMS, composite gadget services, etc.); it is not<br /> reachable from unprivileged userspace. Linux host stacks<br /> normally reject short-wLength control OUTs before they reach<br /> the gadget, so reproducing this required a build that<br /> bypasses that host-side check. With the bypass in place, a<br /> 1-byte payload on a 64-byte Setup produces 63 bytes of<br /> non-canary slab residue in the daemon&amp;#39;s read buffer.<br /> <br /> Fix by copying only ret (actually received) bytes to<br /> userspace.