usb: gadget: f_mass_storage: fix null pointer dereference in fsg_common_set_num_buffers()
Previously fsg_num_buffers_validate() was removed as it was not
necessary due to Kconfig setting the limits for n from 2 to 256 with
default as 2. However, setting the page content in such a way that
kstrtou8() reflects n value as either 0 or 1 bypasses these
restrictions leading to a null pointer dereference if n is 0. Fix
this by adding a check for n < 2 and returning -EINVAL if n is
either 0 or 1 consistent with Kconfig logic.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Linux | Linux | unaffected |
|
|||||||||||||||||||||||||||||||||
| Linux | Linux | affected |
|
No data.
No data.
OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.
| Vendors | Products |
|---|---|
|
Linux
Subscribe
|
Linux Kernel
Subscribe
|
| Source | ID | Title |
|---|---|---|
 Debian DLA |
DLA-4850-1 | linux-6.12 security update |
 Debian DSA |
DSA-6568-1 | linux security update |
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
Fri, 30 Oct 2026 12:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
Wed, 21 Oct 2026 13:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
Sat, 03 Oct 2026 11:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
Fri, 18 Sep 2026 07:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Weaknesses | CWE-476 |
Wed, 16 Sep 2026 10:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_mass_storage: fix null pointer dereference in fsg_common_set_num_buffers() Previously fsg_num_buffers_validate() was removed as it was not necessary due to Kconfig setting the limits for n from 2 to 256 with default as 2. However, setting the page content in such a way that kstrtou8() reflects n value as either 0 or 1 bypasses these restrictions leading to a null pointer dereference if n is 0. Fix this by adding a check for n < 2 and returning -EINVAL if n is either 0 or 1 consistent with Kconfig logic. | |
| Title | usb: gadget: f_mass_storage: fix null pointer dereference in fsg_common_set_num_buffers() | |
| First Time appeared |
Linux
Linux linux Kernel |
|
| CPEs | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | |
| Vendors & Products |
Linux
Linux linux Kernel |
|
| References |
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: Linux
Published:
Updated: 2026-10-30T12:33:51.550Z
Reserved: 2026-09-11T19:38:34.782Z
Link: CVE-2026-90023
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-09-16T11:17:15.250
Modified: 2026-10-30T13:20:39.143
Link: CVE-2026-90023
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-09-18T07:15:04Z