Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-63895— usb: gadget: f_fs: copy only received bytes on short ep0 read

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会开源的一款操作系统内核。 Linux kernel 2.6.35版本存在安全漏洞，该漏洞源于ffs_ep0_read函数在短控制OUT传输时，未限制拷贝到用户空间的数据长度，导致未初始化的slab残留数据泄露给FunctionFS守护进程。

AI Predicted 7.8 Difficulty: Hard EPSS 0.25% · P17

Affected Version Matrix 16

VendorProduct Version RangeStatus
Linux Linux ddf8abd2599491cbad959c700b90ba72a5dce8d0< 90ccf5fb63243fae1b4b3200f3310500500ecf2e affected
ddf8abd2599491cbad959c700b90ba72a5dce8d0< af32dbb2ca0b3d09271ab718d13857a457fa16f2 affected
ddf8abd2599491cbad959c700b90ba72a5dce8d0< e835bf9a055f71874065a40780ca5560b7df8b33 affected
ddf8abd2599491cbad959c700b90ba72a5dce8d0< 88874a19b2b093bfaaa1c0090fa536c44da8c08b affected
ddf8abd2599491cbad959c700b90ba72a5dce8d0< 607730a414773a7cbe3037a64a6c64e72689ff5e affected
ddf8abd2599491cbad959c700b90ba72a5dce8d0< 23c1f7deb9dd8447ecde749850676302aa1e2bd3 affected
ddf8abd2599491cbad959c700b90ba72a5dce8d0< 4e036c10e7f4df5d951c69cc3697bc8e209c6d02 affected
2.6.35 affected
… +8 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-63895

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
usb: gadget: f_fs: copy only received bytes on short ep0 read
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_fs: copy only received bytes on short ep0 read ffs_ep0_read() allocates its control-OUT data buffer with kmalloc() (not kzalloc) at the Length value from the Setup packet, then copies that full len to userspace regardless of how many bytes were actually received: data = kmalloc(len, GFP_KERNEL); ... ret = __ffs_ep0_queue_wait(ffs, data, len); if ((ret > 0) && (copy_to_user(buf, data, len))) ret = -EFAULT; __ffs_ep0_queue_wait() returns req->actual, which on a short control OUT transfer is strictly less than len. The copy_to_user() call still copies len bytes, so on a short OUT the last (len - ret) bytes of the kmalloc() buffer -- uninitialised slab residue -- are delivered to the FunctionFS daemon. Short ep0 OUT completions are specified USB control-transfer behavior and are produced by in-tree UDCs: * dwc2 continues on req->actual < req->length for ep0 DATA OUT (short-not-ok is the only ep0-OUT stall path). * aspeed_udc ends ep0 OUT on rx_len < ep->ep.maxpacket. * renesas_usbf logs "ep0 short packet" and completes the request. * dwc3 stalls on short IN but not on short OUT. A short ep0 OUT is therefore not evidence of a broken UDC; it is a normal condition f_fs has to cope with. The sibling gadgetfs implementation in drivers/usb/gadget/legacy/inode.c already does this correctly via min(len, dev->req->actual) before copy_to_user(). This patch brings f_fs.c to the same safe pattern rather than trimming at a defensive layer. The bug is reached from the FunctionFS device node, which in real deployments is owned by the privileged gadget daemon (adbd, UMS, composite gadget services, etc.); it is not reachable from unprivileged userspace. Linux host stacks normally reject short-wLength control OUTs before they reach the gadget, so reproducing this required a build that bypasses that host-side check. With the bypass in place, a 1-byte payload on a 64-byte Setup produces 63 bytes of non-canary slab residue in the daemon's read buffer. Fix by copying only ret (actually received) bytes to userspace.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会开源的一款操作系统内核。 Linux kernel 2.6.35版本存在安全漏洞，该漏洞源于ffs_ep0_read函数在短控制OUT传输时，未限制拷贝到用户空间的数据长度，导致未初始化的slab残留数据泄露给FunctionFS守护进程。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux ddf8abd2599491cbad959c700b90ba72a5dce8d0 ~ 90ccf5fb63243fae1b4b3200f3310500500ecf2e -
Linux Linux 2.6.35 -

II. Public POCs for CVE-2026-63895

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-63895

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-63895 (7)

Same Patch Batch · Linux · 2026-07-19 · 429 CVEs total

CVE-2026-63795 10.0 CRITICAL 9p: avoid putting oldfid in p9_client_walk() error path
CVE-2026-64056 9.8 CRITICAL net: ethernet: cortina: Make RX SKB per-port
CVE-2026-63886 9.8 CRITICAL scsi: target: iscsi: Validate CHAP_R length before base64 decode
CVE-2026-53399 9.8 CRITICAL nfsd: release layout stid on setlease failure
CVE-2026-53398 9.8 CRITICAL NFSD: Fix SECINFO_NO_NAME decode error cleanup
CVE-2026-63984 9.8 CRITICAL ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress()
CVE-2026-63922 9.8 CRITICAL ipv6: exthdrs: refresh nh after handling HAO option
CVE-2026-64035 9.8 CRITICAL igc: set tx buffer type for SMD frames
CVE-2026-64150 9.8 CRITICAL netfilter: nft_inner: release local_lock before re-enabling softirqs
CVE-2026-63924 9.8 CRITICAL ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo()
CVE-2026-63979 9.8 CRITICAL net/handshake: hand off the pinned file reference to accept_doit
CVE-2026-63800 9.8 CRITICAL pNFS: Fix use-after-free in pnfs_update_layout()
CVE-2026-64037 9.8 CRITICAL wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled
CVE-2026-63978 9.8 CRITICAL net/handshake: Drain pending requests at net namespace exit
CVE-2026-64132 9.8 CRITICAL ipv6: ioam: refresh hdr pointer before ioam6_event()
CVE-2026-63825 9.8 CRITICAL gcov: use atomic counter updates to fix concurrent access crashes
CVE-2026-63857 9.8 CRITICAL net: airoha: Do not read uninitialized fragment address in airoha_dev_xmit()
CVE-2026-64113 9.8 CRITICAL ixgbevf: fix use-after-free in VEPA multicast source pruning
CVE-2026-64016 9.8 CRITICAL ksmbd: fix durable reconnect error path file lifetime
CVE-2026-64162 9.8 CRITICAL idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init()

Showing top 20 of 429 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-63895

No comments yet

Leave a comment