CVE-2026-93120
Description
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: configfs: fix out-of-bounds read of qw_sign os_desc_qw_sign_show() passes OS_STRING_QW_SIGN_LEN as the input length to utf16s_to_utf8s(), but that argument counts UTF-16 code units while OS_STRING_QW_SIGN_LEN (14) is the byte size of qw_sign[]. The array holds only OS_STRING_QW_SIGN_LEN / 2 (7) code units, so the conversion reads up to 7 units (14 bytes) past the end of qw_sign[] into the following members of struct gadget_info when the stored signature fills the array without a NUL terminator, exposing those bytes through the configfs attribute. The store path halves the count for its input bound but passes the full byte count as the utf8s_to_utf16s() output limit; use the destination code-unit count in both directions.
How to fix
- Linux Linuxb895dbed8ac9e12a5ffa1a2165575a8469f8340d, 9b45125501aad2dff7730970461b455b0e0658ee, f6da500b0f8106882598b6dec87fe37d653946cf, a28c486434634f6d1e120711d2b09f3eddea6c98, 7e94cb967778e074411940db4db97f22ed77560c, afbf39c0f2297c6abef6d670a82a2079b0836191, 36315a330e067f7773196940552feacb1debbef1, f63edb54d8f738f9c21e2068c777ae1c097df6b7 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | 76180d716f91f035d9c8639497cf5459b44e1a51 ≤ v < b895dbed8ac9e12a5ffa1a2165575a8469f8340d, 76180d716f91f035d9c8639497cf5459b44e1a51 ≤ v < 9b45125501aad2dff7730970461b455b0e0658ee, 76180d716f91f035d9c8639497cf5459b44e1a51 ≤ v < f6da500b0f8106882598b6dec87fe37d653946cf, 76180d716f91f035d9c8639497cf5459b44e1a51 ≤ v < a28c486434634f6d1e120711d2b09f3eddea6c98, 76180d716f91f035d9c8639497cf5459b44e1a51 ≤ v < 7e94cb967778e074411940db4db97f22ed77560c, 76180d716f91f035d9c8639497cf5459b44e1a51 ≤ v < afbf39c0f2297c6abef6d670a82a2079b0836191, 76180d716f91f035d9c8639497cf5459b44e1a51 ≤ v < 36315a330e067f7773196940552feacb1debbef1, 76180d716f91f035d9c8639497cf5459b44e1a51 ≤ v < f63edb54d8f738f9c21e2068c777ae1c097df6b7, 4.13 | b895dbed8ac9e12a5ffa1a2165575a8469f8340d, 9b45125501aad2dff7730970461b455b0e0658ee, f6da500b0f8106882598b6dec87fe37d653946cf, a28c486434634f6d1e120711d2b09f3eddea6c98, 7e94cb967778e074411940db4db97f22ed77560c, afbf39c0f2297c6abef6d670a82a2079b0836191, 36315a330e067f7773196940552feacb1debbef1, f63edb54d8f738f9c21e2068c777ae1c097df6b7 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.