CVE-2026-90023: usb: gadget: f_mass_storage: fix null pointer dereference in fsg_common_set_num_buffers()
In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: fmassstorage: fix null pointer dereference in fsgcommonsetnumbuffers()
Previously fsgnumbuffersvalidate() was removed as it was not necessary due to Kconfig setting the limits for n from 2 to 256 with default as 2. However, setting the page content in such a way that kstrtou8() reflects n value as either 0 or 1 bypasses these restrictions leading to a null pointer dereference if n is 0. Fix this by adding a check for n < 2 and returning -EINVAL if n is either 0 or 1 consistent with Kconfig logic.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Apply the fix in fsg_common_set_num_buffers() for usb: gadget: f_mass_storage: add a check so that if n is less than 2, the function returns -EINVAL to prevent the null pointer dereference.
Linux kernel (usb: gadget: f_mass_storage) fsg_common_set_num_buffers() parameter n = Return -EINVAL when n < 2
Event History
Frequently Asked Questions
Is the default buffer-count configuration affected?
No. Kconfig restricts the buffer count to 2 through 256, with a default of 2. The issue occurs when page content causes kstrtou8() to interpret the value as 0 or 1, bypassing those expected limits.
What input is needed to trigger the crash?
An actor must be able to set the relevant page content so that the parsed buffer-count value becomes 0 or 1. A value of 0 can lead to a null pointer dereference; the fix rejects both 0 and 1 with -EINVAL.