CVE-2026-93120

CVE CVE-2026-93120EUVD EUVD-2026-82228Published 2026-09-17T16:11:26.000Z

What the advisory describes

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: configfs: fix out-of-bounds read of qw_sign os_desc_qw_sign_show() passes OS_STRING_QW_SIGN_LEN as the input length to utf16s_to_utf8s(), but that argument counts UTF-16 code units while OS_STRING_QW_SIGN_LEN (14) is the byte size of qw_sign[]. The array holds only OS_STRING_QW_SIGN_LEN / 2 (7) code units, so the conversion reads up to 7 units (14 bytes) past the end of qw_sign[] into the following members of struct gadget_info when the stored signature fills the array without a NUL terminator, exposing those bytes through the configfs attribute. The store path halves the count for its input bound but passes the full byte count as the utf8s_to_utf16s() output limit; use the destination code-unit count in both directions.

Source: EUVD (ENISA), in the words of the advisory.

Products the advisory names

These come from the advisory itself, not from any check we performed.

Linux — Linux 76180d716f91f035d9c8639497cf5459b44e1a51 <f63edb54d8f738f9c21e2068c777ae1c097df6b7; patch: 5.15.221; 76180d716f91f035d9c8639497cf5459b44e1a51 <36315a330e067f7773196940552feacb1debbef1; patch: 6.1.188; patch: 6.6.157; patch: 7.3-rc1; 4.13; patch: 0; 76180d716f91f035d9c8639497cf5459b44e1a51 <f6da500b0f8106882598b6dec87fe37d653946cf; 76180d716f91f035d9c8639497cf5459b44e1a51 <7e94cb967778e074411940db4db97f22ed77560c; 76180d716f91f035d9c8639497cf5459b44e1a51 <a28c486434634f6d1e120711d2b09f3eddea6c98; patch: 6.18.52; 76180d716f91f035d9c8639497cf5459b44e1a51 <9b45125501aad2dff7730970461b455b0e0658ee; 76180d716f91f035d9c8639497cf5459b44e1a51 <afbf39c0f2297c6abef6d670a82a2079b0836191; patch: 6.12.110; patch: 7.2.6; 76180d716f91f035d9c8639497cf5459b44e1a51 <b895dbed8ac9e12a5ffa1a2165575a8469f8340d; patch: 5.10.270

The versions shown are the advisory's own. Patchlage compares no version numbers and derives no judgement from them — which version is installed is something a person has to look up.

Carried in the product catalogue

An estate covering these products can be recorded in Patchlage. An advisory about them appears in the next morning's situation report.

Linux — Linux

Does this concern one of your customers?

This page cannot answer that — it does not know your estate. Whoever has recorded their environments gets the answer the morning after publication, together with a paragraph they can forward to the customer unedited.

Try it for 28 days

Patchlage reports hits and suspected hits. About everything else this system says nothing — neither this page nor the situation report ever claims that an estate is safe.