CVE-2026-63895

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the f fs gadget driver where the ffs ep0 read() function allocates a control-OUT data buffer using kmalloc() based on the length specified in the Setup packet. When a short control OUT transfer occurs, the ffs ep0 queue wait() function returns the actual number of bytes received, which is less than the allocated length. However, the subsequent copy to user() call copies the full allocated length to userspace. This results in uninitialized slab residue—leftover data from previous memory allocations—being delivered to the FunctionFS daemon. This condition is reachable via the FunctionFS device node, typically owned by privileged gadget daemons such as adbd or UMS.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.