---
id: CVE-2026-64347
title: 'usb: gadget: composite: fix dead empty check in the USB_DT_OTG handler'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  usb: gadget: composite: fix dead empty check in the USB_DT_OTG handler

  The OTG branch of composite_setup() falls back to the first
  configuration when none is selected:…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 53e6242db8d60da0587d36951cc9434d1a1c21dd <
    2454264b2ab4cf0055c0bfd39e79f830452bd0db
  - >-
    Linux >= 53e6242db8d60da0587d36951cc9434d1a1c21dd <
    d3e72cfef2e38bd588055739a8100d14f9773b17
  - >-
    Linux >= 53e6242db8d60da0587d36951cc9434d1a1c21dd <
    8ac463fe6c0f85bdb1ce8c30e8c9e060802e4483
  - >-
    Linux >= 53e6242db8d60da0587d36951cc9434d1a1c21dd <
    56add2b9b2e89ec61c0761165d758f73004fdfdf
  - >-
    Linux >= 53e6242db8d60da0587d36951cc9434d1a1c21dd <
    91b3ecd34b60f950c50c560974945b6596a6f207
  - >-
    Linux >= 53e6242db8d60da0587d36951cc9434d1a1c21dd <
    01feaf024f29618d5ffa7ab0fd858e0579dcbf7b
  - >-
    Linux >= 53e6242db8d60da0587d36951cc9434d1a1c21dd <
    fcb21bf747640c9d6bd1eda9da85420f076d59c1
  - >-
    Linux >= 53e6242db8d60da0587d36951cc9434d1a1c21dd <
    f8f680609c2b3ab795ffcd6f21585b6dfc46d395
  - Linux 4.3
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-06T16:36:21.482488Z'
published: '2026-07-25'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T16:44:48.115Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-64347'
references:
  - url: 'https://git.kernel.org/stable/c/2454264b2ab4cf0055c0bfd39e79f830452bd0db'
  - url: 'https://git.kernel.org/stable/c/d3e72cfef2e38bd588055739a8100d14f9773b17'
  - url: 'https://git.kernel.org/stable/c/8ac463fe6c0f85bdb1ce8c30e8c9e060802e4483'
  - url: 'https://git.kernel.org/stable/c/56add2b9b2e89ec61c0761165d758f73004fdfdf'
  - url: 'https://git.kernel.org/stable/c/91b3ecd34b60f950c50c560974945b6596a6f207'
  - url: 'https://git.kernel.org/stable/c/01feaf024f29618d5ffa7ab0fd858e0579dcbf7b'
  - url: 'https://git.kernel.org/stable/c/fcb21bf747640c9d6bd1eda9da85420f076d59c1'
  - url: 'https://git.kernel.org/stable/c/f8f680609c2b3ab795ffcd6f21585b6dfc46d395'
tags:
  - cve.org
epss: 0.00095
epssPercentile: 0.006
ingestedAt: '2026-11-06T16:57:43.191Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: composite: fix dead empty check in the USB_DT_OTG handler

The OTG branch of composite_setup() falls back to the first
configuration when none is selected:

	if (cdev->config)
		config = cdev->config;
	else
		config = list_first_entry(&cdev->configs,
					  struct usb_configuration, list);
	if (!config)
		goto done;
	...
	memcpy(req->buf, config->descriptors[0], value);

list_first_entry() never returns NULL. On an empty list it returns
container_of() of the list head. So the "if (!config)" check is dead.

When cdev->configs is empty, config points at the head inside struct
usb_composite_dev. config->descriptors[0] reads whatever sits at that
offset. The memcpy copies up to w_length bytes of it into the response
buffer.

cdev->configs can be empty in two cases. One is a teardown race on
gadget unbind with a control transfer in flight. The other is a driver
that sets is_otg before it adds a config. A reproducer that holds
cdev->configs empty triggers a KASAN fault in this branch.

Use list_first_entry_or_null() so the existing check does its job.

## Affected

- `Linux >= 53e6242db8d60da0587d36951cc9434d1a1c21dd < 2454264b2ab4cf0055c0bfd39e79f830452bd0db`
- `Linux >= 53e6242db8d60da0587d36951cc9434d1a1c21dd < d3e72cfef2e38bd588055739a8100d14f9773b17`
- `Linux >= 53e6242db8d60da0587d36951cc9434d1a1c21dd < 8ac463fe6c0f85bdb1ce8c30e8c9e060802e4483`
- `Linux >= 53e6242db8d60da0587d36951cc9434d1a1c21dd < 56add2b9b2e89ec61c0761165d758f73004fdfdf`
- `Linux >= 53e6242db8d60da0587d36951cc9434d1a1c21dd < 91b3ecd34b60f950c50c560974945b6596a6f207`
- `Linux >= 53e6242db8d60da0587d36951cc9434d1a1c21dd < 01feaf024f29618d5ffa7ab0fd858e0579dcbf7b`
- `Linux >= 53e6242db8d60da0587d36951cc9434d1a1c21dd < fcb21bf747640c9d6bd1eda9da85420f076d59c1`
- `Linux >= 53e6242db8d60da0587d36951cc9434d1a1c21dd < f8f680609c2b3ab795ffcd6f21585b6dfc46d395`
- `Linux 4.3`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.