Linux Kernel CVE-2026-64347

The vulnerability resides in composite_setup() within drivers/usb/gadget/composite.c, the core handler for USB composite device setup requests. When processing a USB_DT_OTG descriptor, the code falls back to list_first_entry() when no active configuration exists - but this kernel macro returns container_of(head->next, ...) and never returns NULL, even on an empty list. This renders the subsequent 'if (!config)' guard permanently dead code. When cdev->configs is genuinely empty, config points into the usb_composite_dev struct head rather than a valid usb_configuration object. The dereference of config->descriptors[0] reads an arbitrary kernel address, and memcpy then copies up to w_length bytes from that pointer into the USB response buffer, triggering a KASAN out-of-bounds or use-after-free fault. CWE-667 is assigned; the root cause is more precisely a dead-check logic error from misuse of the list_first_entry() API. The upstream fix replaces it with list_first_entry_or_null(), making the NULL guard effective. The vulnerable code was introduced at commit 53e6242db8d60da0587d36951cc9434d1a1c21dd (kernel 4.3).