CVE-2026-90023

usb: gadget: f_mass_storage: fix null pointer dereference in fsg_common_set_num_buffers()

State: Published
Severity: Not scored
Published: Sep 16, 2026
Updated: Oct 30, 2026
Reserved: Sep 11, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: f_mass_storage: fix null pointer dereference in fsg_common_set_num_buffers()

Previously fsg_num_buffers_validate() was removed as it was not necessary due to Kconfig setting the limits for n from 2 to 256 with default as 2. However, setting the page content in such a way that kstrtou8() reflects n value as either 0 or 1 bypasses these restrictions leading to a null pointer dereference if n is 0. Fix this by adding a check for n < 2 and returning -EINVAL if n is either 0 or 1 consistent with Kconfig logic.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	fe5a6c48fd954489f51aab151d5dad9254c76419 to before 38edd187a37db0d8e4bf84cc954dbdbe7bfa366fAffected fe5a6c48fd954489f51aab151d5dad9254c76419 to before e54820b9dc1d6d731ecc3e51462445dc952906a7Affected fe5a6c48fd954489f51aab151d5dad9254c76419 to before 5d56dbaeb81d5cd967cdee8ddcc70814b7139246Affected fe5a6c48fd954489f51aab151d5dad9254c76419 to before f4f0fe3ab47ed57ee4974fdd3e9dccb7839a7ebfAffected fe5a6c48fd954489f51aab151d5dad9254c76419 to before 51cc9af4f2d3f0b765266aced66b9b532b423b13Affected fe5a6c48fd954489f51aab151d5dad9254c76419 to before 9e8dd2a7a8ccbb756771ad985b0ad3387ed3c957Affected fe5a6c48fd954489f51aab151d5dad9254c76419 to before b9b5b5df5b8dd3c1572ed267200276a44cc67d8eAffected fe5a6c48fd954489f51aab151d5dad9254c76419 to before 2c0f5ca48674a5b5f9fa4a9c3325aa48053af0bcAffected
LinuxLinux	4.8Affected before 4.8Not affected 5.10.273 through 5.10.Not affected 5.15.224 through 5.15.Not affected 6.1.191 through 6.1.Not affected 6.6.160 through 6.6.Not affected 6.12.112 through 6.12.Not affected 6.18.52 through 6.18.Not affected 7.2.5 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

fe5a6c48fd954489f51aab151d5dad9254c76419 to before 38edd187a37db0d8e4bf84cc954dbdbe7bfa366fAffected
fe5a6c48fd954489f51aab151d5dad9254c76419 to before e54820b9dc1d6d731ecc3e51462445dc952906a7Affected
fe5a6c48fd954489f51aab151d5dad9254c76419 to before 5d56dbaeb81d5cd967cdee8ddcc70814b7139246Affected
fe5a6c48fd954489f51aab151d5dad9254c76419 to before f4f0fe3ab47ed57ee4974fdd3e9dccb7839a7ebfAffected
fe5a6c48fd954489f51aab151d5dad9254c76419 to before 51cc9af4f2d3f0b765266aced66b9b532b423b13Affected
fe5a6c48fd954489f51aab151d5dad9254c76419 to before 9e8dd2a7a8ccbb756771ad985b0ad3387ed3c957Affected
fe5a6c48fd954489f51aab151d5dad9254c76419 to before b9b5b5df5b8dd3c1572ed267200276a44cc67d8eAffected
fe5a6c48fd954489f51aab151d5dad9254c76419 to before 2c0f5ca48674a5b5f9fa4a9c3325aa48053af0bcAffected

LinuxLinux

4.8Affected
before 4.8Not affected
5.10.273 through 5.10.*Not affected
5.15.224 through 5.15.*Not affected
6.1.191 through 6.1.*Not affected
6.6.160 through 6.6.*Not affected
6.12.112 through 6.12.*Not affected
6.18.52 through 6.18.*Not affected
7.2.5 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.