Executive brief
The Linux kernel's USB Audio Class 1 legacy gadget driver contains a logic error in configuration attribute handlers for audio device settings. An inverted null check causes write attempts to fail with memory errors even when successful, and can crash the system on allocation failures. This affects systems using USB audio gadget emulation.
Technical details
The UAC1_STR_ATTRIBUTE macro in the f_uac1_legacy driver defines configfs show/store handlers for audio device file names (fn_play, fn_cap, fn_cntl). The store function contains an inverted null check on the kstrndup() return value: it returns -ENOMEM on successful allocation and dereferences a NULL pointer on allocation failure. While these attributes have been unused for years, the logic error represents a denial-of-service and potential NULL pointer dereference vulnerability. The fix removes the broken macro and its three generated attributes, preserving internal defaults set during driver initialization.
Affected products
- Linux Linux kernel multiple versions (patch backported across stable branches linux-2.6.11.y through linux-7.2.y)
Timeline
- 2026-09-17: disclosed
- 2026-09-14: patched: upstream commit 590d74ec8f488e06b9f1c0f8f0941f45531f3a55