CVE-2026-93120

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An out-of-bounds read exists in the usb gadget configfs component. The function os desc qw sign show() incorrectly uses OS STRING QW SIGN LEN as the input length for utf16s to utf8s(). Because this argument expects a count of UTF-16 code units rather than the byte size of the qw sign[] array, the conversion can read up to 7 units (14 bytes) beyond the array boundary into other members of struct gadget info when the signature lacks a NUL terminator. This allows the exposure of internal memory bytes through the configfs attribute. Additionally, the store path incorrectly uses the full byte count as the output limit for utf8s to utf16s().

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.