CVE-2026-93120: usb: gadget: configfs: fix out-of-bounds read of qw_sign
In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: configfs: fix out-of-bounds read of qwsign
osdescqwsignshow() passes OSSTRINGQWSIGNLEN as the input length to utf16stoutf8s(), but that argument counts UTF-16 code units while OSSTRINGQWSIGNLEN (14) is the byte size of qwsign[]. The array holds only OSSTRINGQWSIGNLEN / 2 (7) code units, so the conversion reads up to 7 units (14 bytes) past the end of qwsign[] into the following members of struct gadgetinfo when the stored signature fills the array without a NUL terminator, exposing those bytes through the configfs attribute.
The store path halves the count for its input bound but passes the full byte count as the utf8stoutf16s() output limit; use the destination code-unit count in both directions.
Affected Software
Event History
Frequently Asked Questions
Under what condition can data be exposed through this issue?
The out-of-bounds read occurs when the stored qw_sign signature fills its array and does not contain a NUL terminator. In that case, reading the relevant configfs attribute can expose up to 14 bytes from following members of struct gadget_info.
What interface is involved in triggering the disclosure?
The affected path is the USB gadget configfs OS-descriptor signature attribute handled by os_desc_qw_sign_show(). The disclosure is exposed through that configfs attribute.
What does the fix change?
The fix uses the destination array's UTF-16 code-unit count as the conversion limit in both the read and store paths. This prevents the UTF-16-to-UTF-8 conversion from treating the 14-byte qw_sign array as if it contained 14 UTF-16 code units.