SB20260720347 - Out-of-bounds read in Linux kernel gadget function driver

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20260720347

SB20260720347 - Out-of-bounds read in Linux kernel gadget function driver

Published: July 20, 2026

Security Bulletin ID SB20260720347
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Local access
Highest impact Information disclosure

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Out-of-bounds read (CVE-ID: CVE-2026-63895)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a local privileged user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in ffs_ep0_read() in the FunctionFS gadget implementation when handling a short ep0 control-OUT read. A local privileged user can trigger a short control-OUT transfer and read back uninitialized kernel heap memory to disclose sensitive information.

The issue is reachable through the FunctionFS device node and requires access to the privileged gadget daemon context. Reproducing the condition also requires bypassing normal host-side checks that usually reject short-wLength control-OUT requests before they reach the gadget.


Remediation

Install update from vendor's website.

References