Out-of-bounds read in Linux kernel - CVE-2026-63895
Published: July 20, 2026
Vulnerability identifier: #VU138762
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2026-63895
CWE-ID: CWE-125
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vendor: Linux Foundation
Affected software:
Linux kernel
Linux kernel
Detailed vulnerability description
The vulnerability allows a local privileged user to disclose sensitive information.
The vulnerability exists due to an out-of-bounds read in ffs_ep0_read() in the FunctionFS gadget implementation when handling a short ep0 control-OUT read. A local privileged user can trigger a short control-OUT transfer and read back uninitialized kernel heap memory to disclose sensitive information.
The issue is reachable through the FunctionFS device node and requires access to the privileged gadget daemon context. Reproducing the condition also requires bypassing normal host-side checks that usually reject short-wLength control-OUT requests before they reach the gadget.
How to mitigate CVE-2026-63895
Install security update from vendor's repository.
Sources
- https://git.kernel.org/stable/c/23c1f7deb9dd8447ecde749850676302aa1e2bd3
- https://git.kernel.org/stable/c/4e036c10e7f4df5d951c69cc3697bc8e209c6d02
- https://git.kernel.org/stable/c/607730a414773a7cbe3037a64a6c64e72689ff5e
- https://git.kernel.org/stable/c/88874a19b2b093bfaaa1c0090fa536c44da8c08b
- https://git.kernel.org/stable/c/90ccf5fb63243fae1b4b3200f3310500500ecf2e
- https://git.kernel.org/stable/c/af32dbb2ca0b3d09271ab718d13857a457fa16f2
- https://git.kernel.org/stable/c/e835bf9a055f71874065a40780ca5560b7df8b33