usb: gadget: f_mass_storage: fix null pointer dereference in fsg_common_set_num_buffers()

MITRE NVD CVE.ORG JSON API

Summary

CVECVE-2026-90023
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2026-09-16 11:17:15 UTC
Updated2026-10-21 13:20:34 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_mass_storage: fix null pointer dereference in fsg_common_set_num_buffers() Previously fsg_num_buffers_validate() was removed as it was not necessary due to Kconfig setting the limits for n from 2 to 256 with default as 2. However, setting the page content in such a way that kstrtou8() reflects n value as either 0 or 1 bypasses these restrictions leading to a null pointer dereference if n is 0. Fix this by adding a check for n < 2 and returning -EINVAL if n is either 0 or 1 consistent with Kconfig logic.

Risk And Classification

EPSS: 0.002190000 probability, percentile 0.112220000 (date 2026-10-05)

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected fe5a6c48fd954489f51aab151d5dad9254c76419 f4f0fe3ab47ed57ee4974fdd3e9dccb7839a7ebf git Not specified
CNA Linux Linux affected fe5a6c48fd954489f51aab151d5dad9254c76419 51cc9af4f2d3f0b765266aced66b9b532b423b13 git Not specified
CNA Linux Linux affected fe5a6c48fd954489f51aab151d5dad9254c76419 9e8dd2a7a8ccbb756771ad985b0ad3387ed3c957 git Not specified
CNA Linux Linux affected fe5a6c48fd954489f51aab151d5dad9254c76419 b9b5b5df5b8dd3c1572ed267200276a44cc67d8e git Not specified
CNA Linux Linux affected fe5a6c48fd954489f51aab151d5dad9254c76419 2c0f5ca48674a5b5f9fa4a9c3325aa48053af0bc git Not specified
CNA Linux Linux affected 4.8 Not specified
CNA Linux Linux unaffected 4.8 semver Not specified
CNA Linux Linux unaffected 6.6.160 6.6.* semver Not specified
CNA Linux Linux unaffected 6.12.112 6.12.* semver Not specified
CNA Linux Linux unaffected 6.18.52 6.18.* semver Not specified
CNA Linux Linux unaffected 7.2.5 7.2.* semver Not specified
CNA Linux Linux unaffected 7.3 * original_commit_for_fix Not specified

References

ReferenceSourceLinkTags
git.kernel.org/stable/c/2c0f5ca48674a5b5f9fa4a9c3325aa48053af0bc 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/9e8dd2a7a8ccbb756771ad985b0ad3387ed3c957 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/b9b5b5df5b8dd3c1572ed267200276a44cc67d8e 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/51cc9af4f2d3f0b765266aced66b9b532b423b13 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/f4f0fe3ab47ed57ee4974fdd3e9dccb7839a7ebf 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report