Junglewise Threat Intelligence

CVE-2026-63895: Linux Kernel information disclosure in USB FunctionFS ep0 read

CVE-2026-63895 · Severity: info · CVSS 4.3 · Published 2026-07-19

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's USB gadget driver could allow a privileged process to read sensitive information from the system's memory. This occurs when the system handles specific USB control messages, potentially exposing data that was previously stored in memory to a management program (like a mobile phone's connection daemon). While an exploit requires physical access or a compromised high-privilege service, it could lead to the leakage of cryptographic keys or other sensitive system data.

Technical details

An information disclosure vulnerability exists in the ffs_ep0_read() function within the Linux kernel's USB gadget framework (FunctionFS). The function allocates a buffer using kmalloc() based on the length specified in a USB Setup packet but fails to account for 'short' transfers where the actual received data is less than the requested length. When a short transfer occurs, copy_to_user() still copies the full requested length, resulting in uninitialized slab residue being leaked to the FunctionFS daemon. This vulnerability is reachable via the FunctionFS device node, typically owned by privileged daemons like adbd. The issue has been patched by ensuring only the actual number of received bytes (req->actual) are copied to userspace.

Affected products

  • Linux Linux Kernel versions prior to 6.9.5, 6.6.33, 6.1.93, 5.15.161, 5.10.219, 5.4.278, 4.19.316

Timeline

  • 2026-04-19: other: Patch submitted by Michael Bommarito
  • 2026-06-09: patched: Patch committed to stable trees
  • 2026-07-19: disclosed: CVE published

References

Related threats