OCTOBER 22, 2026
Live Feed
Back to database
Case File

CVE-2026-64327

UNKNOWN · CVSS N/A EPSS 0.20%

Source: NVD + CISA KEV + EPSS · Published 2026-07-25 · Last synced 2026-08-24

CyberRota Analysis

AI-Generated

The vulnerability affects the Linux kernel's USB gadget functionality, specifically in how endpoint direction checks are initialized. This flaw can lead to incorrect DMA directions when early userspace ioctls are executed before a USB host connection, potentially compromising data integrity. Organizations utilizing Linux systems with USB gadget support should prioritize this fix to ensure proper endpoint operation and prevent potential data handling issues.

CVE
CVE-2026-64327
Severity
UNKNOWN
CVSS
N/A
EPSS
0.20%
Linux

Original NVD Description

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_fs: Initialize epfile->in early to fix endpoint direction checks When parsing endpoint descriptors, ffs_data_got_descs() generates the eps_addrmap which contains the endpoint direction. However, epfile->in was previously only populated in ffs_func_eps_enable() which executes upon USB host connection. As a result, early userspace ioctls like FUNCTIONFS_DMABUF_ATTACH that run before the host connects would see epfile->in as 0, leading to incorrect DMA directions. By moving the initialization to ffs_epfiles_create(), epfile->in is accurate before userspace opens the endpoint files.