CVE-2026-93056: usb: gadget: f_uac1_legacy: remove broken string configfs attributes
In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: fuac1legacy: remove broken string configfs attributes
The UAC1STRATTRIBUTE macro defines configfs show/store handlers for the fnplay, fncap, and fncntl string options. The store function contains an inverted null check on the kstrndup() return value.
This means every write attempt returns -ENOMEM on success and dereferences a NULL pointer on allocation failure. The attributes have been broken and unused for many years.
Remove the UAC1STRATTRIBUTE macro and the three attributes it generated. The internal defaults (FILEPCMPLAYBACK, FILEPCMCAPTURE, FILECONTROL) set in faudioallocinst() are unaffected.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
usb: gadget: f_uac1_legacyfrom your environment.Remove the UAC1_STR_ATTRIBUTE macro and the three broken string configfs attributes (fn_play, fn_cap, and fn_cntl string options) so the unused/broken configfs show/store handlers are no longer present.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems using the UAC1 legacy USB gadget function are exposed only when someone attempts to write the fn_play, fn_cap, or fn_cntl string options through configfs. The affected attributes were unused for many years.
What does an attacker or local user need to do to trigger the flaw?
They need the ability to write one of the affected configfs string attributes. A normal successful allocation causes the write to fail with -ENOMEM, while an allocation failure leads to a NULL-pointer dereference.
Are the default UAC1 legacy audio file settings affected?
No. The internal defaults FILE_PCM_PLAYBACK, FILE_PCM_CAPTURE, and FILE_CONTROL, set in f_audio_alloc_inst(), are unaffected.
What can be done if the fix cannot be applied immediately?
Do not write to the fn_play, fn_cap, or fn_cntl configfs attributes. The affected attributes have been removed by the fix, while the internal default settings remain available.