Executive brief
The Linux kernel's USB mass storage gadget driver contains a null pointer dereference vulnerability in the buffer allocation logic. An attacker can bypass kernel configuration restrictions by crafting specific input values, causing the system to crash or potentially leading to denial of service. This affects systems exposing USB mass storage functionality.
Technical details
The vulnerability is a null pointer dereference in the fsg_common_set_num_buffers() function in drivers/usb/gadget/function/f_mass_storage.c. The root cause is the removal of input validation (fsg_num_buffers_validate()) which previously enforced a minimum value of 2 for the buffer count parameter. An attacker can provide a crafted input value of 0 or 1 through the sysfs interface to bypass the Kconfig-enforced range check (which restricts n to 2–256), triggering a null pointer dereference when memory allocation fails. The fix adds an explicit check returning -EINVAL if n is less than 2. This is a local/adjacent attack requiring write access to the affected sysfs attribute.
Affected products
- Linux Linux kernel multiple versions (see git commits for affected branches)
Timeline
- 2026-09-16: disclosed: Published to NVD
- 2026-08-18: patched: Fix committed by Jeffin Philip
- 2026-09-01: patched: Fix merged into stable tree