{"id":"CVE-2026-93120","revision":"4de881f5ab334d82b20f50a2f0d529ae","records":[{"revision":"4de881f5ab334d82b20f50a2f0d529ae","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-93120","aliases":[],"title":"usb: gadget: configfs: fix out-of-bounds read of qw_sign","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: configfs: fix out-of-bounds read of qw_sign\n\nos_desc_qw_sign_show() passes OS_STRING_QW_SIGN_LEN as the input\nlength to utf16s_to_utf8s(), but that argument counts UTF-16 code\nunits while OS_STRING_QW_SIGN_LEN (14) is the byte size of qw_sign[].\nThe array holds only OS_STRING_QW_SIGN_LEN / 2 (7) code units, so the\nconversion reads up to 7 units (14 bytes) past the end of qw_sign[]\ninto the following members of struct gadget_info when the stored\nsignature fills the array without a NUL terminator, exposing those\nbytes through the configfs attribute.\n\nThe store path halves the count for its input bound but passes the\nfull byte count as the utf8s_to_utf16s() output limit; use the\ndestination code-unit count in both directions.","state":0,"publishedAt":"2026-09-17T16:11:26.548+00:00","modifiedAt":"2026-10-19T09:05:53.824+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/usb/gadget/configfs.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"76180d716f91f035d9c8639497cf5459b44e1a51\",\n                            \"lessThan\": \"b895dbed8ac9e12a5ffa1a2165575a8469f8340d\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"76180d716f91f035d9c8639497cf5459b44e1a51\",\n                            \"lessThan\": \"9b45125501aad2dff7730970461b455b0e0658ee\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"76180d716f91f035d9c8639497cf5459b44e1a51\",\n                            \"lessThan\": \"f6da500b0f8106882598b6dec87fe37d653946cf\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"76180d716f91f035d9c8639497cf5459b44e1a51\",\n                            \"lessThan\": \"a28c486434634f6d1e120711d2b09f3eddea6c98\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"76180d716f91f035d9c8639497cf5459b44e1a51\",\n                            \"lessThan\": \"7e94cb967778e074411940db4db97f22ed77560c\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"76180d716f91f035d9c8639497cf5459b44e1a51\",\n                            \"lessThan\": \"afbf39c0f2297c6abef6d670a82a2079b0836191\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"76180d716f91f035d9c8639497cf5459b44e1a51\",\n                            \"lessThan\": \"36315a330e067f7773196940552feacb1debbef1\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"76180d716f91f035d9c8639497cf5459b44e1a51\",\n                            \"lessThan\": \"f63edb54d8f738f9c21e2068c777ae1c097df6b7\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/usb/gadget/configfs.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"4.13\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"4.13\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.10.270\",\n                            \"lessThanOrEqual\": \"5.10.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.221\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.188\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.157\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.110\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.52\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.6\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/b895dbed8ac9e12a5ffa1a2165575a8469f8340d","https://git.kernel.org/stable/c/9b45125501aad2dff7730970461b455b0e0658ee","https://git.kernel.org/stable/c/f6da500b0f8106882598b6dec87fe37d653946cf","https://git.kernel.org/stable/c/a28c486434634f6d1e120711d2b09f3eddea6c98","https://git.kernel.org/stable/c/7e94cb967778e074411940db4db97f22ed77560c","https://git.kernel.org/stable/c/afbf39c0f2297c6abef6d670a82a2079b0836191","https://git.kernel.org/stable/c/36315a330e067f7773196940552feacb1debbef1","https://git.kernel.org/stable/c/f63edb54d8f738f9c21e2068c777ae1c097df6b7"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-93120","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-93120","identifiers":["CVE-2026-93120"]},"retained":false,"historicalAffected":[]}],"coverage":[]}