[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"cve-CVE-2026-64347":3},{"id":4,"cve_id":5,"euvd_id":6,"summary":7,"published":8,"cvss_data":9,"is_remote":20,"cwes":21,"cpes":23,"technologies":27,"references":29,"score":38,"epss_score":39,"epss_percentile":40,"is_kev":20,"cisa_kev_date_added":41,"cisa_kev_due_date":41,"cisa_ssvc":42,"attack_mappings":48,"exploits":64},369370,"CVE-2026-64347","EUVD-2026-48891","In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: composite: fix dead empty check in the USB_DT_OTG handler\n\nThe OTG branch of composite_setup() falls back to the first\nconfiguration when none is selected:\n\n\tif (cdev->config)\n\t\tconfig = cdev->config;\n\telse\n\t\tconfig = list_first_entry(&cdev->configs,\n\t\t\t\t\t  struct usb_configuration, list);\n\tif (!config)\n\t\tgoto done;\n\t...\n\tmemcpy(req->buf, config->descriptors[0], value);\n\nlist_first_entry() never returns NULL. On an empty list it returns\ncontainer_of() of the list head. So the \"if (!config)\" check is dead.\n\nWhen cdev->configs is empty, config points at the head inside struct\nusb_composite_dev. config->descriptors[0] reads whatever sits at that\noffset. The memcpy copies up to w_length bytes of it into the response\nbuffer.\n\ncdev->configs can be empty in two cases. One is a teardown race on\ngadget unbind with a control transfer in flight. The other is a driver\nthat sets is_otg before it adds a config. A reproducer that holds\ncdev->configs empty triggers a KASAN fault in this branch.\n\nUse list_first_entry_or_null() so the existing check does its job.","2026-07-25T10:17:00Z",{"cvss_v3.1":10},{"scope":11,"version":12,"baseScore":13,"attackVector":14,"baseSeverity":15,"vectorString":16,"integrityImpact":17,"userInteraction":17,"attackComplexity":18,"availabilityImpact":19,"privilegesRequired":18,"confidentialityImpact":17},"UNCHANGED","3.1",5.5,"LOCAL","MEDIUM","CVSS:3.1\u002FAV:L\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:N\u002FI:N\u002FA:H","NONE","LOW","HIGH",false,[22],"CWE-667",[24,25,26],"cpe:2.3:o:linux:linux_kernel:7.2:rc1:*:*:*:*:*:*","cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","cpe:2.3:o:linux:linux_kernel:7.2:rc2:*:*:*:*:*:*",[28],"Linux Linux Kernel",[30,31,32,33,34,35,36,37],"https:\u002F\u002Fgit.kernel.org\u002Fstable\u002Fc\u002F01feaf024f29618d5ffa7ab0fd858e0579dcbf7b","https:\u002F\u002Fgit.kernel.org\u002Fstable\u002Fc\u002F2454264b2ab4cf0055c0bfd39e79f830452bd0db","https:\u002F\u002Fgit.kernel.org\u002Fstable\u002Fc\u002F56add2b9b2e89ec61c0761165d758f73004fdfdf","https:\u002F\u002Fgit.kernel.org\u002Fstable\u002Fc\u002F8ac463fe6c0f85bdb1ce8c30e8c9e060802e4483","https:\u002F\u002Fgit.kernel.org\u002Fstable\u002Fc\u002F91b3ecd34b60f950c50c560974945b6596a6f207","https:\u002F\u002Fgit.kernel.org\u002Fstable\u002Fc\u002Fd3e72cfef2e38bd588055739a8100d14f9773b17","https:\u002F\u002Fgit.kernel.org\u002Fstable\u002Fc\u002Ff8f680609c2b3ab795ffcd6f21585b6dfc46d395","https:\u002F\u002Fgit.kernel.org\u002Fstable\u002Fc\u002Ffcb21bf747640c9d6bd1eda9da85420f076d59c1",0.28,0.00095,0.00588,null,{"timestamp":41,"automatable":43,"tech_impact":44,"exploitation":45,"cisa_decision":46,"cisa_remediation_timeline":47},"no","partial","none",{},"FSU",[49,55],{"name":50,"source":51,"tactics":52,"technique_id":54},"Exploitation for Privilege Escalation","attack_vector",[53],"privilege-escalation","T1068",{"name":56,"source":57,"cwe_ids":58,"tactics":59,"capec_ids":61,"technique_id":63},"Application or System Exploitation","capec",[22],[60],"impact",[62],"CAPEC-25","T1499.004",[]]