CVE-2026-64347

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the USB gadget composite handler within the composite setup() function. When processing the OTG branch, the code attempts to fall back to the first configuration using list first entry(). However, list first entry() does not return NULL even if the list is empty, rendering the subsequent if (!config) check ineffective. If cdev->configs is empty—which can occur during a teardown race on gadget unbind or when a driver sets is otg before adding a configuration—the system reads an incorrect memory offset and copies data into the response buffer via memcpy(). This can lead to a KASAN fault.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.