Description
In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: gadget: Fix looping of queued SG entries The dwc3_request->num_queued_sgs is decremented on completion. If a partially completed request is handled, then the dwc3_request->num_queued_sgs no longer reflects the total number of num_queued_sgs (it would be cleared). Correctly check the number of request SG entries remained to be prepare and queued. Failure to do this may cause null pointer dereference when accessing non-existent SG entry.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
c96e6725db9d6a04ac1bee881e3034b636d9f71c to < 8ceb21d76426bbe7072cc3e43281e70c0d664cc7affectedc96e6725db9d6a04ac1bee881e3034b636d9f71c to < 0247da93bf62d33304b7bf97850ebf2a86e06d28affectedc96e6725db9d6a04ac1bee881e3034b636d9f71c to < c9e72352a10ae89a430449f7bfeb043e75c255d9affectedc96e6725db9d6a04ac1bee881e3034b636d9f71c to < 1534f6f69393aac773465d80d31801b554352627affectedc96e6725db9d6a04ac1bee881e3034b636d9f71c to < b7c3d0b59213ebeedff63d128728ce0b3d7a51ecaffectedc96e6725db9d6a04ac1bee881e3034b636d9f71c to < 70777a23a54e359cfdfafc625a57cd56434f3859affectedc96e6725db9d6a04ac1bee881e3034b636d9f71c to < b7fc65f5141c24785dc8c19249ca4efcf71b3524affected
Linux Linux
Default version status: affected
4.18affected0 to < 4.18unaffected5.10.231 to ≤ 5.10.*unaffected5.15.174 to ≤ 5.15.*unaffected6.1.120 to ≤ 6.1.*unaffected6.6.64 to ≤ 6.6.*unaffected6.11.11 to ≤ 6.11.*unaffected6.12.2 to ≤ 6.12.*unaffected6.13 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/8ceb21d76426bbe7072cc3e43281e70c0d664cc7 ↗
- https://git.kernel.org/stable/c/0247da93bf62d33304b7bf97850ebf2a86e06d28 ↗
- https://git.kernel.org/stable/c/c9e72352a10ae89a430449f7bfeb043e75c255d9 ↗
- https://git.kernel.org/stable/c/1534f6f69393aac773465d80d31801b554352627 ↗
- https://git.kernel.org/stable/c/b7c3d0b59213ebeedff63d128728ce0b3d7a51ec ↗
- https://git.kernel.org/stable/c/70777a23a54e359cfdfafc625a57cd56434f3859 ↗
- https://git.kernel.org/stable/c/b7fc65f5141c24785dc8c19249ca4efcf71b3524 ↗
- https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html ↗
- https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html ↗