CVE-2026-31615

usb: gadget: renesas_usb3: validate endpoint index in standard request handlers

State: Published
Severity: Not scored
Published: Apr 24, 2026
Updated: Jun 14, 2026
Reserved: Mar 9, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: renesas_usb3: validate endpoint index in standard request handlers

The GET_STATUS and SET/CLEAR_FEATURE handlers extract the endpoint number from the host-supplied wIndex without any sort of validation. Fix this up by validating the number of endpoints actually match up with the number the device has before attempting to dereference a pointer based on this math.

This is just like what was done in commit ee0d382feb44 ("usb: gadget: aspeed_udc: validate endpoint index for ast udc") for the aspeed driver.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	746bfe63bba37ad55956b7377c9af494e7e28929 to before 7caaf76207f50c77abfd788380e19b2c23a94415Affected 746bfe63bba37ad55956b7377c9af494e7e28929 to before c4e5ae6db2328d2d9ed55d3005a36c13faab0752Affected 746bfe63bba37ad55956b7377c9af494e7e28929 to before 360aa6e71870a175a6d86af905be2ca171639eb3Affected 746bfe63bba37ad55956b7377c9af494e7e28929 to before 1b2bfedccc4fb8c9572e1ea464f905424c91de2aAffected 746bfe63bba37ad55956b7377c9af494e7e28929 to before adb8014599fdf0818d3d93f1f74e06cd0bdec08dAffected 746bfe63bba37ad55956b7377c9af494e7e28929 to before 44216e3dd4455b798899b50eedb0ec3831dff8e0Affected 746bfe63bba37ad55956b7377c9af494e7e28929 to before 37f430b2240655e6b0199a92aa1057e4d621be51Affected 746bfe63bba37ad55956b7377c9af494e7e28929 to before e3d42598f2995cdc07b7779874e7c5f8a1b773dbAffected 746bfe63bba37ad55956b7377c9af494e7e28929 to before f880aac8a57ebd92abfa685d45424b2998ac1059Affected
LinuxLinux	4.5Affected before 4.5Not affected 5.10.258 through 5.10.Not affected 5.15.209 through 5.15.Not affected 6.1.175 through 6.1.Not affected 6.6.136 through 6.6.Not affected 6.12.83 through 6.12.Not affected 6.18.24 through 6.18.Not affected 6.19.14 through 6.19.Not affected 7.0.1 through 7.0.Not affected 7.1 and laterNot affected

Product

Versions

LinuxLinux

746bfe63bba37ad55956b7377c9af494e7e28929 to before 7caaf76207f50c77abfd788380e19b2c23a94415Affected
746bfe63bba37ad55956b7377c9af494e7e28929 to before c4e5ae6db2328d2d9ed55d3005a36c13faab0752Affected
746bfe63bba37ad55956b7377c9af494e7e28929 to before 360aa6e71870a175a6d86af905be2ca171639eb3Affected
746bfe63bba37ad55956b7377c9af494e7e28929 to before 1b2bfedccc4fb8c9572e1ea464f905424c91de2aAffected
746bfe63bba37ad55956b7377c9af494e7e28929 to before adb8014599fdf0818d3d93f1f74e06cd0bdec08dAffected
746bfe63bba37ad55956b7377c9af494e7e28929 to before 44216e3dd4455b798899b50eedb0ec3831dff8e0Affected
746bfe63bba37ad55956b7377c9af494e7e28929 to before 37f430b2240655e6b0199a92aa1057e4d621be51Affected
746bfe63bba37ad55956b7377c9af494e7e28929 to before e3d42598f2995cdc07b7779874e7c5f8a1b773dbAffected
746bfe63bba37ad55956b7377c9af494e7e28929 to before f880aac8a57ebd92abfa685d45424b2998ac1059Affected

LinuxLinux

4.5Affected
before 4.5Not affected
5.10.258 through 5.10.*Not affected
5.15.209 through 5.15.*Not affected
6.1.175 through 6.1.*Not affected
6.6.136 through 6.6.*Not affected
6.12.83 through 6.12.*Not affected
6.18.24 through 6.18.*Not affected
6.19.14 through 6.19.*Not affected
7.0.1 through 7.0.*Not affected
7.1 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.