CVE-2026-63895: Linux Kernel Information Disclosure Bug

CVE-2026-63895 Overview

CVE-2026-63895 is an uninitialized memory disclosure vulnerability in the Linux kernel's USB gadget FunctionFS driver (drivers/usb/gadget/function/f_fs.c). The ffs_ep0_read() function allocates a control-OUT data buffer with kmalloc() sized to the Setup packet's Length field, then unconditionally copies the full length to userspace. On a short control-OUT transfer, the trailing bytes of the buffer contain uninitialised slab residue that reaches the FunctionFS daemon.

A 1-byte payload delivered against a 64-byte Setup produces 63 bytes of slab residue in the daemon's read buffer. The fix trims the copy to the actual number of bytes received via req->actual.

Critical Impact
Uninitialised kernel slab memory can leak into privileged userspace gadget daemons on short ep0 OUT transfers, exposing residual data that may include sensitive kernel state.

Affected Products

Linux kernel — drivers/usb/gadget/function/f_fs.c (FunctionFS)
Systems running privileged gadget daemons (adbd, UMS, composite gadget services)
USB Device Controllers (UDCs) that produce short ep0 OUT completions: dwc2, aspeed_udc, renesas_usbf

Discovery Timeline

2026-07-19 - CVE-2026-63895 published to NVD
2026-07-19 - Last updated in NVD database

Technical Details for CVE-2026-63895

Vulnerability Analysis

The defect resides in ffs_ep0_read() within the FunctionFS gadget driver. The function allocates its control-OUT buffer using kmalloc(len, GFP_KERNEL), which does not zero the allocated memory. It then submits the request via __ffs_ep0_queue_wait(), which returns req->actual — the number of bytes actually received on the endpoint.

When the host issues a short control-OUT transfer, req->actual is strictly less than len. The subsequent copy_to_user(buf, data, len) still transfers the full requested length. The tail (len - ret) bytes contain uninitialised slab data that the kernel hands to userspace. This behavior is classified as an uninitialized memory disclosure [CWE-908].

Root Cause

The root cause is the mismatch between the allocation size and the actual data length used in the userspace copy. FunctionFS trusts the Setup packet's wLength value for both allocation and copy sizing, ignoring the actual transferred byte count. The sibling gadgetfs implementation in drivers/usb/gadget/legacy/inode.c already handles this correctly by using min(len, dev->req->actual) before copy_to_user().

Attack Vector

The vulnerable code path is reached through the FunctionFS device node, which in production deployments is owned by the privileged gadget daemon. It is not reachable from unprivileged local users. Linux host stacks normally reject short-wLength control OUTs before they reach the gadget, so triggering the leak requires a host build that bypasses that host-side check.

Short ep0 OUT completions are legitimate USB control-transfer behavior. In-tree UDCs including dwc2, aspeed_udc, and renesas_usbf produce them under normal operation, so the condition is not evidence of a broken controller.

No verified exploitation code is publicly available. The mechanism is described in the upstream kernel commits referenced by this CVE. See the Kernel Commit c/23c1f7d for the authoritative fix.

Detection Methods for CVE-2026-63895

Indicators of Compromise

Unexpected non-zero, non-canary byte patterns in FunctionFS daemon read buffers following short control-OUT transfers.
Kernel log entries such as ep0 short packet from renesas_usbf correlated with FunctionFS reads returning full-length data.
Custom or modified USB host stacks issuing control-OUT transfers with wLength values larger than the actual data phase.

Detection Strategies

Audit installed kernel versions against the stable trees patched by the referenced commits and flag hosts running unpatched USB gadget stacks.
Instrument FunctionFS daemons (adbd, UMS services) to validate that received buffer lengths match the semantic payload size and log discrepancies.
Monitor loaded kernel modules on gadget-capable devices for libcomposite, usb_f_fs, and UDC drivers listed in the advisory.

Monitoring Recommendations

Collect kernel and dmesg logs from embedded and mobile gadget deployments for review of ep0 short-packet events.
Track USB gadget daemon crashes or anomalous read sizes as potential indicators of host-side probing.
Include the FunctionFS device node (/dev/ffs-*) in file access telemetry to detect unexpected consumers beyond the sanctioned daemon.

How to Mitigate CVE-2026-63895

Immediate Actions Required

Apply the upstream kernel patch that copies only ret (actually received) bytes to userspace in ffs_ep0_read().
Update to a stable kernel release containing one of the referenced fix commits for your supported branch.
Inventory devices exposing FunctionFS (Android handsets, embedded gadget appliances) and prioritize patching those with untrusted USB host exposure.

Patch Information

The fix has been merged across multiple stable kernel trees. Reference commits include Kernel Commit c/23c1f7d, Kernel Commit c/4e036c1, Kernel Commit c/607730a, Kernel Commit c/88874a1, Kernel Commit c/90ccf5f, Kernel Commit c/af32dbb, and Kernel Commit c/e835bf9. The change replaces the unconditional copy_to_user(buf, data, len) with a copy sized to the actual received byte count.

Workarounds

Where kernel updates are not immediately feasible, disable the FunctionFS gadget function (usb_f_fs module) if the deployment does not require it.
Restrict physical USB access on gadget-mode devices, since triggering the leak requires a controlled host issuing crafted short control-OUT transfers.
Verify that the FunctionFS device node permissions remain restricted to the intended privileged daemon and are not exposed to additional processes.

bash

# Verify kernel version and FunctionFS module status
uname -r
lsmod | grep -E 'usb_f_fs|libcomposite'

# Unload FunctionFS if unused (verify no active gadget daemon depends on it)
sudo modprobe -r usb_f_fs

# Blacklist to prevent auto-load on gadget-capable hosts that do not need it
echo 'blacklist usb_f_fs' | sudo tee /etc/modprobe.d/blacklist-ffs.conf