{"id":"CVE-2026-98764","summary":"usb: gadget: f_fs: Fix NULL pointer dereference in FUNCTIONFS_ENDPOINT_DESC","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: f_fs: Fix NULL pointer dereference in FUNCTIONFS_ENDPOINT_DESC\n\nWhen user space sets up FunctionFS with only full-speed descriptors\n(e.g., flags = FUNCTIONFS_HAS_FS_DESC) and the gadget operates at a\nhigher speed (such as USB_SPEED_HIGH or USB_SPEED_SUPER),\nconfig_ep_by_speed() detects that the function lacks descriptors for\nthe current speed, logs a warning, and falls back to full-speed\ndescriptors. The endpoint is then successfully enabled via\nusb_ep_enable(), and epfile-\u003eep becomes valid.\n\nHowever, when user space subsequently issues the FUNCTIONFS_ENDPOINT_DESC\nioctl to query the endpoint descriptor, ffs_epfile_ioctl() selects the\ndescriptor index solely based on gadget-\u003espeed:\n\n\tswitch (epfile-\u003effs-\u003egadget-\u003espeed) {\n\tcase USB_SPEED_SUPER:\n\tcase USB_SPEED_SUPER_PLUS:\n\t\tdesc_idx = 2;\n\t\tbreak;\n\tcase USB_SPEED_HIGH:\n\t\tdesc_idx = 1;\n\t\tbreak;\n\tdefault:\n\t\tdesc_idx = 0;\n\t}\n\tdesc = epfile-\u003eep-\u003edescs[desc_idx];\n\tmemcpy(&desc1, desc, desc-\u003ebLength);\n\nBecause user space only supplied full-speed descriptors,\nepfile-\u003eep-\u003edescs[1] is NULL. Dereferencing desc-\u003ebLength triggers an\nimmediate kernel NULL pointer dereference panic.\n\nFix this by falling back through lower speed descriptors if the current\nspeed descriptor was not supplied, matching the fallback logic in\nconfig_ep_by_speed() and historical f_fs behavior. If still missing,\nfall back to epfile-\u003eep-\u003eep-\u003edesc (the active descriptor), and return\n-EINVAL safely if no valid descriptor is found. In addition, mark desc\nas const to match struct usb_ep::desc and avoid discarding qualifiers.","modified":"2026-10-19T02:47:18.321188381Z","published":"2026-10-18T15:47:56.225Z","database_specific":{"cna_assigner":"Linux","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/98xxx/CVE-2026-98764.json"},"references":[{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"},{"type":"WEB","url":"https://git.kernel.org/stable/c/35ab269602e1f7c4c0fe6ea3477264bea77eced3"},{"type":"WEB","url":"https://git.kernel.org/stable/c/7811d8e26c77f8eea79e22d0d14c67ec0658b348"},{"type":"WEB","url":"https://git.kernel.org/stable/c/9cd072788c76595529eb38f42bf94d23852f8534"},{"type":"WEB","url":"https://git.kernel.org/stable/c/9d8761b3c133f6c6a6d3486839dac60e2cf4bfe3"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/98xxx/CVE-2026-98764.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98764"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"c559a353410939c0884e83bdb0e2420a986ac53b"},{"fixed":"9d8761b3c133f6c6a6d3486839dac60e2cf4bfe3"},{"fixed":"7811d8e26c77f8eea79e22d0d14c67ec0658b348"},{"fixed":"35ab269602e1f7c4c0fe6ea3477264bea77eced3"},{"fixed":"9cd072788c76595529eb38f42bf94d23852f8534"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-98764.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.18.0"},{"fixed":"6.12.113"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.56"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"7.2.10"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-98764.json"}}],"schema_version":"1.9.0"}