CVE-2026-98764Medium· 4.4▾ Sunlit

kernel: usb: gadget: f_fs: Fix NULL pointer dereference in FUNCTIONFS_ENDPOINT_DESC (CVE-2026-98764)

▾ Sunlit zone — Low / medium · no exploitation signal

Depth score24/ 100 · Low

impact 24.2 · likelihood 0 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Oct 18, 2026

Updated

Oct 23, 2026

CVSS

4.4

Vendor

Red Hat

Product

Linux

CWE

CWE-476

Depth score

24 · Low

EPSS

0.17% · p6

Platforms

—

Source

CSAF

Vector

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

EPSS history

Exploit-prediction probability, daily snapshots since Oct 20.

0.2% → 0.2%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

5 events · 6 days

Oct 18, 2026Published
Disclosed via CSAF
Oct 20, 2026EPSS first tracked
0.2%
Oct 23, 2026Record revised
Last analysed / modified upstream
Oct 23, 2026CVSS changed
— → 4.4
Oct 23, 2026Severity changed
none → medium

Red Hat CWE-476 #csaf #vex #red-hat #cve.org

Affected

Linux >= c559a353410939c0884e83bdb0e2420a986ac53b < 06ac8609d6d185ac18c1d6a6a8a9b99e398bd124
Linux >= c559a353410939c0884e83bdb0e2420a986ac53b < 9d8761b3c133f6c6a6d3486839dac60e2cf4bfe3
Linux >= c559a353410939c0884e83bdb0e2420a986ac53b < 7811d8e26c77f8eea79e22d0d14c67ec0658b348
Linux >= c559a353410939c0884e83bdb0e2420a986ac53b < 35ab269602e1f7c4c0fe6ea3477264bea77eced3
Linux >= c559a353410939c0884e83bdb0e2420a986ac53b < 9cd072788c76595529eb38f42bf94d23852f8534
Linux 3.18

Full technical detail▾

Overview

A flaw was found in the Linux kernel's USB (Universal Serial Bus) FunctionFS gadget subsystem. A local user can cause a Denial of Service (DoS) by triggering a kernel crash when querying endpoint descriptors on a USB gadget configured with lower-speed settings than the active connection speed. In this scenario, the driver accesses an uninitialized memory pointer without proper validation, leading to an immediate system crash.

Vendor advisories

Red Hat VEX · Moderate · updated 2026-10-23 · vex

kernel: usb: gadget: f_fs: Fix NULL pointer dereference in FUNCTIONFS_ENDPOINT_DESC — rated Moderate by Red Hat. Released 2026-10-18, updated 2026-10-23.

Not affected:

Red Hat Enterprise Linux 10
Red Hat Enterprise Linux 6
Red Hat Enterprise Linux 7
Red Hat Enterprise Linux 8
Red Hat Enterprise Linux 9
Red Hat OpenShift Container Platform 4

Remediation

Refer to the advisory for fix availability.

References

Change history

Field changes observed since this record was first indexed.

Oct 23, 2026CVSS — → 4.4
Oct 23, 2026Severity none → medium

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#csaf#vex#red-hat#cve.org

← Back to feed