CVE-2026-64347: Linux Kernel Privilege Escalation Flaw

CVE-2026-64347 Overview

CVE-2026-64347 is a Linux kernel vulnerability in the USB gadget composite driver. The flaw resides in the USB_DT_OTG handler within composite_setup(). A dead empty-list check allows the function to dereference an invalid pointer when cdev->configs is empty. The kernel then copies memory from an incorrect offset into a USB control response buffer. A reproducer triggers a Kernel Address Sanitizer (KASAN) fault in this branch. The fix replaces list_first_entry() with list_first_entry_or_null() so the existing NULL check functions correctly.

Critical Impact
An attacker with local access to a USB gadget device can trigger an out-of-bounds read, potentially leaking kernel memory contents through the USB control transfer response or causing a denial of service.

Affected Products

Linux kernel USB gadget composite driver (drivers/usb/gadget/composite.c)
Systems using USB gadget mode with OTG (On-The-Go) descriptor support
Multiple stable kernel branches (see referenced patch commits)

Discovery Timeline

2026-07-25 - CVE-2026-64347 published to NVD
2026-07-25 - Last updated in NVD database

Technical Details for CVE-2026-64347

Vulnerability Analysis

The vulnerability [CWE-125] resides in the OTG branch of composite_setup() in the Linux kernel USB gadget composite driver. When a USB host issues a USB_DT_OTG descriptor request, the handler attempts to fall back to the first configuration if none is currently selected. The code calls list_first_entry(&cdev->configs, struct usb_configuration, list) and then checks if (!config) before proceeding.

The check is dead. list_first_entry() never returns NULL. On an empty list it returns the container_of() computation of the list head, which points inside struct usb_composite_dev itself rather than a valid usb_configuration. Execution falls through to memcpy(req->buf, config->descriptors[0], value), which reads whatever data sits at the calculated offset and copies up to w_length bytes into the USB response buffer.

Root Cause

The root cause is misuse of the list_first_entry() macro. Kernel developers used a NULL check that only makes sense with the NULL-safe variant list_first_entry_or_null(). The result is an out-of-bounds read from the composite device structure whenever cdev->configs is empty at the time of the control transfer.

Attack Vector

Two conditions can leave cdev->configs empty. The first is a teardown race during gadget unbind while a control transfer is in flight. The second is a gadget driver that sets is_otg before adding any configuration. An attacker on the USB host side can issue crafted control requests targeting the OTG descriptor to trigger the invalid read. The out-of-bounds contents are returned to the host in the USB response, enabling potential kernel memory disclosure. Reproducers confirm a KASAN fault in this branch.

Refer to the upstream patches for the exact code change, including Kernel Patch Commit 01feaf0 and Kernel Patch Commit fcb21bf.

Detection Methods for CVE-2026-64347

Indicators of Compromise

KASAN reports in kernel logs referencing composite_setup or usb_composite_dev with out-of-bounds read warnings
Unexpected USB control transfer responses containing non-descriptor data on OTG-enabled gadget devices
System crashes or oops messages tied to USB gadget teardown races

Detection Strategies

Enable KASAN on test kernels to surface out-of-bounds reads in the USB gadget subsystem
Audit gadget drivers for use of is_otg before any usb_add_config() call
Monitor dmesg for warnings originating in drivers/usb/gadget/composite.c

Monitoring Recommendations

Collect kernel logs centrally and alert on KASAN or oops entries containing composite_setup
Track kernel package versions across the fleet to identify unpatched hosts running USB gadget mode
Inventory embedded and IoT devices that expose USB device or OTG functionality to untrusted hosts

How to Mitigate CVE-2026-64347

Immediate Actions Required

Apply the upstream stable kernel patches referenced in the NVD entry to affected kernel branches
Rebuild and redeploy custom kernels used on embedded or gadget-mode systems
Restrict physical USB access on devices operating in USB gadget or OTG mode until patched

Patch Information

The fix replaces list_first_entry() with list_first_entry_or_null() in the USB_DT_OTG branch of composite_setup(), allowing the existing if (!config) check to correctly bail out on an empty configuration list. Patches have been backported to multiple stable branches. See Kernel Patch Commit 2454264, Kernel Patch Commit 56add2b, Kernel Patch Commit 8ac463f, Kernel Patch Commit 91b3ecd, Kernel Patch Commit d3e72cf, and Kernel Patch Commit f8f6806.

Workarounds

Disable USB gadget mode or unload composite gadget modules on systems that do not require them
Audit and correct out-of-tree gadget drivers to add at least one configuration before setting is_otg
Enforce physical access controls on USB ports of devices operating as USB peripherals

bash

# Identify loaded USB gadget composite modules
lsmod | grep -E 'libcomposite|g_'

# Unload the composite gadget stack where not required
sudo modprobe -r g_multi g_ether g_mass_storage libcomposite

# Verify installed kernel version against distribution advisories
uname -r