« Volver al listado

CVE-2026-64327

Estado: AnalizadaMedia (5.5)—

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: f_fs: Initialize epfile->in early to fix endpoint direction checks

When parsing endpoint descriptors, ffs_data_got_descs() generates the eps_addrmap which contains the endpoint direction. However, epfile->in was previously only populated in ffs_func_eps_enable() which executes upon USB host connection. As a result, early userspace ioctls like FUNCTIONFS_DMABUF_ATTACH that run before the host connects would see epfile->in as 0, leading to incorrect DMA directions.

By moving the initialization to ffs_epfiles_create(), epfile->in is accurate before userspace opens the endpoint files.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Linux — Linux Kernel

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-64327",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.5,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "7b07a2a7ca02a20124b552be96c5a56910795488",
              "lessThan": "82cf1142e5ccf2b6d6d22ef713aaf3e5f2b5716b",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "7b07a2a7ca02a20124b552be96c5a56910795488",
              "lessThan": "9e04055ab5fc0470a0031ee6934739f9aa8f34a5",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "7b07a2a7ca02a20124b552be96c5a56910795488",
              "lessThan": "f99f32ea9aa976afcbec20647ed33b50a52002c1",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "7b07a2a7ca02a20124b552be96c5a56910795488",
              "lessThan": "82cfd4739011bdc7e87b5d585703427e89ddfaa5",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "drivers/usb/gadget/function/f_fs.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.9"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "6.9",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "6.12.96",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.39",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.1.4",
              "versionType": "semver",
              "lessThanOrEqual": "7.1.*"
            },
            {
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "drivers/usb/gadget/function/f_fs.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-07-25T10:17:14.327",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/82cf1142e5ccf2b6d6d22ef713aaf3e5f2b5716b",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/82cfd4739011bdc7e87b5d585703427e89ddfaa5",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/9e04055ab5fc0470a0031ee6934739f9aa8f34a5",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/f99f32ea9aa976afcbec20647ed33b50a52002c1",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: f_fs: Initialize epfile->in early to fix endpoint direction checks\n\nWhen parsing endpoint descriptors, ffs_data_got_descs() generates the\neps_addrmap which contains the endpoint direction. However, epfile->in\nwas previously only populated in ffs_func_eps_enable() which executes\nupon USB host connection. As a result, early userspace ioctls like\nFUNCTIONFS_DMABUF_ATTACH that run before the host connects would see\nepfile->in as 0, leading to incorrect DMA directions.\n\nBy moving the initialization to ffs_epfiles_create(), epfile->in is\naccurate before userspace opens the endpoint files."
    }
  ],
  "lastModified": "2026-09-04T14:50:56.703",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "95CEF1E2-98DB-4D14-8BB5-1BF3FA9BF03C",
              "versionEndExcluding": "6.12.96",
              "versionStartIncluding": "6.9"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "914AE4BC-3D59-4C5A-9DB5-9CE327B429F7",
              "versionEndExcluding": "6.18.39",
              "versionStartIncluding": "6.13"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6228DDD6-4557-4AA3-9F43-AB995D471E42",
              "versionEndExcluding": "7.1.4",
              "versionStartIncluding": "6.19"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:7.2:rc1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5E8B9085-7ADB-4A05-89EF-12949B6A0509"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:7.2:rc2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1FC0D50D-9D58-4947-A197-A5A3FF07E7E3"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}