CVE Explorer

CVE-2026-64347

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: composite: fix dead empty check in the USB_DT_OTG handler The OTG branch of composite_setup() falls back to the first configuration when none is selected: if (cdev->config) config = cdev->config; else config = list_first_entry(&cdev->configs, struct usb_configuration, list); if (!config) goto done; ... memcpy(req->buf, config->descriptors[0], value); list_first_entry() never returns NULL. On an

Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:8246a7ed2532ac0b7427199a15ddbca7ed3c5cd0bc1e2a446a7dcd5076300354

Known exploited

Not asserted

Disputed

Stale source

Conflicts

Preserved source conflicts

No provider value was silently selected as the winner.

affected · 2 assertions

{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/usb/gadget/composite.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.3"},{"lessThan":"4.3","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.261","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.212","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.178","versionType":"semver"},{"…

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:8f6cca7f11d6c1eea767f94449471f6be55ed668d8d2f2ea2da3032b214fdc98 · sha256:b6ea61d552f39362… · /containers/cna/affected/1

{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/usb/gadget/composite.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"2454264b2ab4cf0055c0bfd39e79f830452bd0db","status":"affected","version":"53e6242db8d60da0587d36951cc9434d1a1c21dd","versionType":"git"},{"lessThan":"d3e72cfef2e38bd588055739a8100d14f9773b17","status":"affected","version":"53e6242db8d60da0587d36951cc9434d1a1c21dd","versionType":"git"},{"lessThan":"8ac463fe6c0f85bdb1ce8c30e8c9e060802e4483","status":"affected","version":"53e6242db8d60da…

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:8f6cca7f11d6c1eea767f94449471f6be55ed668d8d2f2ea2da3032b214fdc98 · sha256:b6ea61d552f39362… · /containers/cna/affected/0

Affected products and versions

2 source assertions

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:8f6cca7f11d6c1eea767f94449471f6be55ed668d8d2f2ea2da3032b214fdc98 · sha256:b6ea61d552f39362… · /containers/cna/affected/1

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:8f6cca7f11d6c1eea767f94449471f6be55ed668d8d2f2ea2da3032b214fdc98 · sha256:b6ea61d552f39362… · /containers/cna/affected/0

Source references

8 source assertions

{"url":"https://git.kernel.org/stable/c/01feaf024f29618d5ffa7ab0fd858e0579dcbf7b"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:8f6cca7f11d6c1eea767f94449471f6be55ed668d8d2f2ea2da3032b214fdc98 · sha256:b6ea61d552f39362… · /containers/cna/references/5

{"url":"https://git.kernel.org/stable/c/2454264b2ab4cf0055c0bfd39e79f830452bd0db"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:8f6cca7f11d6c1eea767f94449471f6be55ed668d8d2f2ea2da3032b214fdc98 · sha256:b6ea61d552f39362… · /containers/cna/references/0

{"url":"https://git.kernel.org/stable/c/56add2b9b2e89ec61c0761165d758f73004fdfdf"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:8f6cca7f11d6c1eea767f94449471f6be55ed668d8d2f2ea2da3032b214fdc98 · sha256:b6ea61d552f39362… · /containers/cna/references/3

{"url":"https://git.kernel.org/stable/c/8ac463fe6c0f85bdb1ce8c30e8c9e060802e4483"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:8f6cca7f11d6c1eea767f94449471f6be55ed668d8d2f2ea2da3032b214fdc98 · sha256:b6ea61d552f39362… · /containers/cna/references/2

{"url":"https://git.kernel.org/stable/c/91b3ecd34b60f950c50c560974945b6596a6f207"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:8f6cca7f11d6c1eea767f94449471f6be55ed668d8d2f2ea2da3032b214fdc98 · sha256:b6ea61d552f39362… · /containers/cna/references/4

{"url":"https://git.kernel.org/stable/c/d3e72cfef2e38bd588055739a8100d14f9773b17"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:8f6cca7f11d6c1eea767f94449471f6be55ed668d8d2f2ea2da3032b214fdc98 · sha256:b6ea61d552f39362… · /containers/cna/references/1

{"url":"https://git.kernel.org/stable/c/f8f680609c2b3ab795ffcd6f21585b6dfc46d395"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:8f6cca7f11d6c1eea767f94449471f6be55ed668d8d2f2ea2da3032b214fdc98 · sha256:b6ea61d552f39362… · /containers/cna/references/7

{"url":"https://git.kernel.org/stable/c/fcb21bf747640c9d6bd1eda9da85420f076d59c1"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:8f6cca7f11d6c1eea767f94449471f6be55ed668d8d2f2ea2da3032b214fdc98 · sha256:b6ea61d552f39362… · /containers/cna/references/6

Attribution and limitations

CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer