Description
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: configfs: Fix OOB read on empty string write When writing an empty string to either 'qw_sign' or 'landingPage' sysfs attributes, the store functions attempt to access page[l - 1] before validating that the length 'l' is greater than zero. This patch fixes the vulnerability by adding a check at the beginning of os_desc_qw_sign_store() and webusb_landingPage_store() to handle the zero-length input case gracefully by returning immediately.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
87213d388e927aaa88b21d5ff7e1f75ca2288da1 to < 78b41148cfea2a3f04d87adf3a71b21735820a37affected87213d388e927aaa88b21d5ff7e1f75ca2288da1 to < d68b7c8fefbaeae8f065b84e40cf64baf4cc0c76affected87213d388e927aaa88b21d5ff7e1f75ca2288da1 to < 15a87206879951712915c03c8952a73d6a74721eaffected87213d388e927aaa88b21d5ff7e1f75ca2288da1 to < 2798111f8e504ac747cce911226135d50b8de468affected87213d388e927aaa88b21d5ff7e1f75ca2288da1 to < 58bdd5160184645771553ea732da5c2887fc9bd1affected87213d388e927aaa88b21d5ff7e1f75ca2288da1 to < 783ea37b237a9b524f1e5ca018ea17d772ee0ea0affected87213d388e927aaa88b21d5ff7e1f75ca2288da1 to < 22b7897c289cc25d99c603f5144096142a30d897affected87213d388e927aaa88b21d5ff7e1f75ca2288da1 to < 3014168731b7930300aab656085af784edc861f6affected
Linux Linux
Default version status: affected
3.16affected0 to < 3.16unaffected5.4.297 to ≤ 5.4.*unaffected5.10.241 to ≤ 5.10.*unaffected5.15.190 to ≤ 5.15.*unaffected6.1.147 to ≤ 6.1.*unaffected6.6.100 to ≤ 6.6.*unaffected6.12.40 to ≤ 6.12.*unaffected6.15.8 to ≤ 6.15.*unaffected6.16 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/78b41148cfea2a3f04d87adf3a71b21735820a37 ↗
- https://git.kernel.org/stable/c/d68b7c8fefbaeae8f065b84e40cf64baf4cc0c76 ↗
- https://git.kernel.org/stable/c/15a87206879951712915c03c8952a73d6a74721e ↗
- https://git.kernel.org/stable/c/2798111f8e504ac747cce911226135d50b8de468 ↗
- https://git.kernel.org/stable/c/58bdd5160184645771553ea732da5c2887fc9bd1 ↗
- https://git.kernel.org/stable/c/783ea37b237a9b524f1e5ca018ea17d772ee0ea0 ↗
- https://git.kernel.org/stable/c/22b7897c289cc25d99c603f5144096142a30d897 ↗
- https://git.kernel.org/stable/c/3014168731b7930300aab656085af784edc861f6 ↗
- https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html ↗
- https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html ↗