Baitaphish
Security intelligence
SearchLatest briefing
CVE Explorer

CVE-2026-63895

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_fs: copy only received bytes on short ep0 read ffs_ep0_read() allocates its control-OUT data buffer with kmalloc() (not kzalloc) at the Length value from the Setup packet, then copies that full len to userspace regardless of how many bytes were actually received: data = kmalloc(len, GFP_KERNEL); ... ret = __ffs_ep0_queue_wait(ffs, data, len); if ((ret > 0) && (copy_to_user(buf, data, len)))
Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:e59579ddf5c369514a69767b28cb25af475635f519521c0ec57e9b4d8363e534
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
1

Preserved source conflicts

No provider value was silently selected as the winner.

affected · 2 assertions

{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/usb/gadget/function/f_fs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"90ccf5fb63243fae1b4b3200f3310500500ecf2e","status":"affected","version":"ddf8abd2599491cbad959c700b90ba72a5dce8d0","versionType":"git"},{"lessThan":"af32dbb2ca0b3d09271ab718d13857a457fa16f2","status":"affected","version":"ddf8abd2599491cbad959c700b90ba72a5dce8d0","versionType":"git"},{"lessThan":"e835bf9a055f71874065a40780ca5560b7df8b33","status":"affected","version":"ddf8abd2599…

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:db705e6f03e61bcf84b957a789ee8791a7bb3bc39a6df8284d4041fc9b5a3fd8 · sha256:648929697db79170… · /containers/cna/affected/0

{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/usb/gadget/function/f_fs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.35"},{"lessThan":"2.6.35","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.210","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.176","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.143","versionType":"sem…

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:db705e6f03e61bcf84b957a789ee8791a7bb3bc39a6df8284d4041fc9b5a3fd8 · sha256:648929697db79170… · /containers/cna/affected/1

Affected products and versions

2 source assertions
{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/usb/gadget/function/f_fs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"90ccf5fb63243fae1b4b3200f3310500500ecf2e","status":"affected","version":"ddf8abd2599491cbad959c700b90ba72a5dce8d0","versionType":"git"},{"lessThan":"af32dbb2ca0b3d09271ab718d13857a457fa16f2","status":"affected","version":"ddf8abd2599491cbad959c700b90ba72a5dce8d0","versionType":"git"},{"lessThan":"e835bf9a055f71874065a40780ca5560b7df8b33","status":"affected","version":"ddf8abd2599…
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:db705e6f03e61bcf84b957a789ee8791a7bb3bc39a6df8284d4041fc9b5a3fd8 · sha256:648929697db79170… · /containers/cna/affected/0
{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/usb/gadget/function/f_fs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.35"},{"lessThan":"2.6.35","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.210","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.176","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.143","versionType":"sem…
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:db705e6f03e61bcf84b957a789ee8791a7bb3bc39a6df8284d4041fc9b5a3fd8 · sha256:648929697db79170… · /containers/cna/affected/1

Source references

7 source assertions
{"url":"https://git.kernel.org/stable/c/23c1f7deb9dd8447ecde749850676302aa1e2bd3"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:db705e6f03e61bcf84b957a789ee8791a7bb3bc39a6df8284d4041fc9b5a3fd8 · sha256:648929697db79170… · /containers/cna/references/5
{"url":"https://git.kernel.org/stable/c/4e036c10e7f4df5d951c69cc3697bc8e209c6d02"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:db705e6f03e61bcf84b957a789ee8791a7bb3bc39a6df8284d4041fc9b5a3fd8 · sha256:648929697db79170… · /containers/cna/references/6
{"url":"https://git.kernel.org/stable/c/607730a414773a7cbe3037a64a6c64e72689ff5e"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:db705e6f03e61bcf84b957a789ee8791a7bb3bc39a6df8284d4041fc9b5a3fd8 · sha256:648929697db79170… · /containers/cna/references/4
{"url":"https://git.kernel.org/stable/c/88874a19b2b093bfaaa1c0090fa536c44da8c08b"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:db705e6f03e61bcf84b957a789ee8791a7bb3bc39a6df8284d4041fc9b5a3fd8 · sha256:648929697db79170… · /containers/cna/references/3
{"url":"https://git.kernel.org/stable/c/90ccf5fb63243fae1b4b3200f3310500500ecf2e"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:db705e6f03e61bcf84b957a789ee8791a7bb3bc39a6df8284d4041fc9b5a3fd8 · sha256:648929697db79170… · /containers/cna/references/0
{"url":"https://git.kernel.org/stable/c/af32dbb2ca0b3d09271ab718d13857a457fa16f2"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:db705e6f03e61bcf84b957a789ee8791a7bb3bc39a6df8284d4041fc9b5a3fd8 · sha256:648929697db79170… · /containers/cna/references/1
{"url":"https://git.kernel.org/stable/c/e835bf9a055f71874065a40780ca5560b7df8b33"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:db705e6f03e61bcf84b957a789ee8791a7bb3bc39a6df8284d4041fc9b5a3fd8 · sha256:648929697db79170… · /containers/cna/references/2

Attribution and limitations

  • CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer