CVE-2026-64347

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> usb: gadget: composite: fix dead empty check in the USB_DT_OTG handler<br /> <br /> The OTG branch of composite_setup() falls back to the first<br /> configuration when none is selected:<br /> <br /> if (cdev-&gt;config)<br /> config = cdev-&gt;config;<br /> else<br /> config = list_first_entry(&amp;cdev-&gt;configs,<br /> struct usb_configuration, list);<br /> if (!config)<br /> goto done;<br /> ...<br /> memcpy(req-&gt;buf, config-&gt;descriptors[0], value);<br /> <br /> list_first_entry() never returns NULL. On an empty list it returns<br /> container_of() of the list head. So the "if (!config)" check is dead.<br /> <br /> When cdev-&gt;configs is empty, config points at the head inside struct<br /> usb_composite_dev. config-&gt;descriptors[0] reads whatever sits at that<br /> offset. The memcpy copies up to w_length bytes of it into the response<br /> buffer.<br /> <br /> cdev-&gt;configs can be empty in two cases. One is a teardown race on<br /> gadget unbind with a control transfer in flight. The other is a driver<br /> that sets is_otg before it adds a config. A reproducer that holds<br /> cdev-&gt;configs empty triggers a KASAN fault in this branch.<br /> <br /> Use list_first_entry_or_null() so the existing check does its job.