CVE-2026-64347 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, Linux distribution maintainers, and organizations using Linux kernel-based systems should assess exposure and apply patches. They should verify Linux kernel versions and configurations for potential exposure and monitor for unusual USB gadget activity.

Why it matters

A vulnerability in the Linux kernel's USB gadget composite driver could allow an attacker to trigger a KASAN fault. Linux kernel developers and maintainers, Linux distribution maintainers, and organizations using Linux kernel-based systems should assess exposure and apply patches.

• Verify Linux kernel versions and configurations for potential exposure
• Assess and apply patches from Linux kernel maintainers
• Monitor for unusual USB gadget activity

Technical summary

The vulnerability exists in the USB_DT_OTG handler of the composite_setup() function in the Linux kernel's USB gadget composite driver. When the cdev->configs list is empty, the list_first_entry() function returns the list head, which can lead to a read of an arbitrary memory location. This can trigger a KASAN fault. The vulnerability has been resolved in Linux kernel versions 4.3 to 7.2 rc2. Linux kernel developers and maintainers should assess exposure and apply patches. The patch fixes the issue by using list_first_entry_or_null() instead of list_first_entry().

Defensive priority

Medium

Recommended defensive actions

• Review and apply patches from Linux kernel maintainers
• Inventory Linux kernel versions for potential exposure
• Monitor for unusual USB gadget activity
• Verify Linux kernel versions and configurations for potential exposure
• Assess and apply patches from Linux kernel maintainers
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The vulnerability was introduced in the Linux kernel and has been resolved. The affected versions are 4.3 to 7.2 rc2. The CVE Program and NVD provide official records and assessments. Linux kernel developers should verify the patch and apply it to affected systems. The patch fixes a KASAN fault in the USB_DT_OTG handler of the composite_setup() function. The vulnerability exists when the cdev->configs list is empty, and the list_first_entry() function returns the list head, leading to a read of an arbitrary memory location.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.