Skip to main content

Linux Kernel CVE-2026-64327

| EUVDEUVD-2026-48871 MEDIUM
2026-07-25 Linux GHSA-gjhh-5f46-ffh6
Linux Red Hat Suse
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local low-privilege access to FunctionFS endpoint nodes required; incorrect DMA direction causes kernel crash (A:H) with no confidentiality or integrity impact.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
5.5 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

6
Metadata Corrected
Sep 04, 2026 - 15:40 vuln.today
tag: Information Disclosure removed
Analysis Generated
Sep 04, 2026 - 14:53 vuln.today
CVSS changed
Sep 04, 2026 - 14:52 NVD
5.5 (MEDIUM)
Patch available
Jul 25, 2026 - 11:18 EUVD
CVE Published
Jul 25, 2026 - 08:49 cve.org
UNKNOWN (no severity yet)
CVE Published
Jul 25, 2026 - 08:49 nvd
MEDIUM 5.5

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: f_fs: Initialize epfile->in early to fix endpoint direction checks

When parsing endpoint descriptors, ffs_data_got_descs() generates the eps_addrmap which contains the endpoint direction. However, epfile->in was previously only populated in ffs_func_eps_enable() which executes upon USB host connection. As a result, early userspace ioctls like FUNCTIONFS_DMABUF_ATTACH that run before the host connects would see epfile->in as 0, leading to incorrect DMA directions.

By moving the initialization to ffs_epfiles_create(), epfile->in is accurate before userspace opens the endpoint files.

AnalysisAI

The USB gadget FunctionFS (f_fs) subsystem in the Linux kernel fails to initialize the endpoint direction field (epfile->in) until USB host connection, leaving it zero when userspace performs early DMA ioctl calls such as FUNCTIONFS_DMABUF_ATTACH before a host connects. This incorrect DMA direction causes kernel-mode availability loss - crashes or hangs - on systems actively using FunctionFS-based USB gadgets with DMABUF. No public exploit has been identified, and EPSS probability stands at 0.21% (11th percentile), reflecting very low opportunistic exploitation risk.

Technical ContextAI

The vulnerability resides in drivers/usb/gadget/function/f_fs.c within the Linux kernel's FunctionFS gadget driver, which allows userspace to implement USB gadget functions via a mounted filesystem interface. The epfile->in field marks whether an endpoint is IN (device-to-host) or OUT (host-to-device) and is used to set the correct DMA transfer direction when attaching DMA buffers via the FUNCTIONFS_DMABUF_ATTACH ioctl. Previously, this field was only populated in ffs_func_eps_enable(), called exclusively upon USB host enumeration. Any userspace ioctl issued before host connection would therefore read epfile->in as 0, treating IN endpoints as OUT or vice versa, corrupting DMA state. The fix moves the initialization into ffs_epfiles_create(), which executes during endpoint descriptor parsing - before any userspace opens endpoint files. No CWE is formally assigned, but this maps to CWE-665 (Improper Initialization). Affected kernel commit range begins from 7b07a2a7ca02a20124b552be96c5a56910795488 (when DMABUF support was introduced to FunctionFS).

RemediationAI

Update to a patched Linux kernel stable release: 6.12.96, 6.18.39, 7.1.4, or 7.2-rc3, using the fix commits available at git.kernel.org/stable/c/82cf1142e5ccf2b6d6d22ef713aaf3e5f2b5716b, 9e04055ab5fc0470a0031ee6934739f9aa8f34a5, f99f32ea9aa976afcbec20647ed33b50a52002c1, and 82cfd4739011bdc7e87b5d585703427e89ddfaa5. As a compensating control on unpatched systems, restrict filesystem permissions on FunctionFS endpoint device nodes so only trusted processes can open them and issue DMA ioctls - this prevents the race condition from being triggered by unprivileged users. Systems that do not use USB gadget functionality can also unload or blacklist the usb_f_fs kernel module (modprobe -r usb_f_fs), eliminating the attack surface entirely with no functional trade-off in non-gadget environments.

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected

Share

CVE-2026-64327 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy