Executive brief
The Linux kernel's USB gadget configuration system contains a buffer over-read vulnerability in the handling of Windows-compatible device signatures. An attacker with local access to configfs attributes could read sensitive data from kernel memory that should not be exposed, potentially revealing system configuration details or cryptographic material.
Technical details
The vulnerability exists in drivers/usb/gadget/configfs.c in the os_desc_qw_sign_show() and os_desc_qw_sign_store() functions. The root cause is a unit mismatch: the functions pass OS_STRING_QW_SIGN_LEN (14 bytes) to UTF-16 encoding/decoding functions that expect the count in code units (7 UTF-16 code units = 14 bytes). When a fully-populated signature array lacks a NUL terminator, the read operation extends 14 bytes past the end of the qw_sign[] array into adjacent struct members of gadget_info, and those out-of-bounds bytes are exposed through the configfs interface. The fix divides the byte-count parameter by 2 to correctly specify the code-unit length. No authentication or special privileges beyond configfs access are required; the attacker must be able to read the os_desc_qw_sign attribute. Patches are available in stable kernel branches.
Affected products
- Linux Linux kernel Linux 4.x through 7.x (multiple stable branches)
Timeline
- 2026-09-17: disclosed: CVE-2026-93120 published on NVD
- 2026-09-14: patched: Patches committed to stable kernel branches
- 2026-06-17: other: Original patch authored by Michael Bommarito