Описание
In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: f_fs: Initialize epfile->in early to fix endpoint direction checks
When parsing endpoint descriptors, ffs_data_got_descs() generates the eps_addrmap which contains the endpoint direction. However, epfile->in was previously only populated in ffs_func_eps_enable() which executes upon USB host connection. As a result, early userspace ioctls like FUNCTIONFS_DMABUF_ATTACH that run before the host connects would see epfile->in as 0, leading to incorrect DMA directions.
By moving the initialization to ffs_epfiles_create(), epfile->in is accurate before userspace opens the endpoint files.
In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: f_fs: Initialize epfile->in early to fix endpoint direction checks
When parsing endpoint descriptors, ffs_data_got_descs() generates the eps_addrmap which contains the endpoint direction. However, epfile->in was previously only populated in ffs_func_eps_enable() which executes upon USB host connection. As a result, early userspace ioctls like FUNCTIONFS_DMABUF_ATTACH that run before the host connects would see epfile->in as 0, leading to incorrect DMA directions.
By moving the initialization to ffs_epfiles_create(), epfile->in is accurate before userspace opens the endpoint files.
Ссылки
- https://nvd.nist.gov/vuln/detail/CVE-2026-64327
- https://git.kernel.org/stable/c/82cf1142e5ccf2b6d6d22ef713aaf3e5f2b5716b
- https://git.kernel.org/stable/c/82cfd4739011bdc7e87b5d585703427e89ddfaa5
- https://git.kernel.org/stable/c/9e04055ab5fc0470a0031ee6934739f9aa8f34a5
- https://git.kernel.org/stable/c/f99f32ea9aa976afcbec20647ed33b50a52002c1
EPSS
CVE ID
Связанные уязвимости
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_fs: Initialize epfile->in early to fix endpoint direction checks When parsing endpoint descriptors, ffs_data_got_descs() generates the eps_addrmap which contains the endpoint direction. However, epfile->in was previously only populated in ffs_func_eps_enable() which executes upon USB host connection. As a result, early userspace ioctls like FUNCTIONFS_DMABUF_ATTACH that run before the host connects would see epfile->in as 0, leading to incorrect DMA directions. By moving the initialization to ffs_epfiles_create(), epfile->in is accurate before userspace opens the endpoint files.
A flaw was found in the Linux kernel's FunctionFS (f_fs) module, which handles USB gadget functionality. This vulnerability occurs because the endpoint direction (`epfile->in`) was not correctly initialized until a USB host connected. Consequently, early operations initiated by userspace programs could encounter incorrect data transfer directions, potentially leading to unintended data access or corruption.
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_fs: Initialize epfile->in early to fix endpoint direction checks When parsing endpoint descriptors, ffs_data_got_descs() generates the eps_addrmap which contains the endpoint direction. However, epfile->in was previously only populated in ffs_func_eps_enable() which executes upon USB host connection. As a result, early userspace ioctls like FUNCTIONFS_DMABUF_ATTACH that run before the host connects would see epfile->in as 0, leading to incorrect DMA directions. By moving the initialization to ffs_epfiles_create(), epfile->in is accurate before userspace opens the endpoint files.
In the Linux kernel, the following vulnerability has been resolved: u ...
EPSS