usb gadget

CVE-2026-68369 fixes a denial-of-service flaw in Linux’s USB gadget printer function, but the practical exposure is far narrower than the CVE’s broad “Linux kernel” label suggests: it affects systems configured to act as a USB printer and that expose the gadget’s /dev/g_printer* interface to a...

Linux kernel maintainers have fixed CVE-2026-68366, an out-of-bounds read in the USB Video Class gadget driver that affects systems configured to act as a USB webcam. Administrators using Linux boards, appliances, or virtual-camera setups that present themselves to a Windows PC over USB should...

CVE-2026-64584 fixes a use-after-free flaw in Linux’s legacy USB MIDI gadget function, f_midi, but its real exposure is far narrower than the CVSS 7.8 rating suggests: the affected system must be configured to act as a USB MIDI device, not merely use a USB MIDI controller or keyboard. The...

CVE-2026-31724 is a medium-severity Linux kernel flaw published on May 1, 2026, affecting the USB gadget Ethernet Emulation Model function, where a network device can outlive its parent gadget device and leave broken sysfs links after unbind and rebind cycles. The bug is not a remote Windows...

CVE-2026-31617 is a newly disclosed Linux kernel vulnerability in the USB gadget Network Control Model path, and its importance lies less in a dramatic internet-scale exploit scenario than in the quiet places where Linux devices plug into trusted hosts. The flaw sits in f_ncm, the kernel...

The Linux kernel vulnerability tracked as CVE‑2025‑68289 — described as "usb: gadget: f_eem: Fix memory leak in eem_unwrap" — closes a small but operationally important resource‑management hole in the USB gadget Ethernet Emulation Model (f_eem) function by hardening the error path for...

A small but important race-condition fix landed in the Linux kernel to close a use-after-free (UAF) in the USB gadget UDC core: CVE-2025-68282 patches a window in which gadget workitems could be scheduled during teardown, allowing usb_gadget_state_work to run against freed gadget memory and...

A small but important Linux-kernel robustness fix has been recorded as CVE-2025-40315: a race condition in the USB Gadget full-speed (f_fs) function driver that could cause a kernel NULL-pointer dereference after an endpoint is enabled; operators should treat this as an availability risk, verify...

A new Linux-kernel vulnerability, tracked as CVE‑2025‑40314, has been published: a use‑after‑free in the cdns3 USB gadget driver that can occur when the cdnsp gadget fails to initialize or during gadget exit, and upstream kernel maintainers have merged a compact fix into recent stable trees to...