{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-63895 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2026-63895 is a vulnerability in Linux, published on 19 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-63895 and fix it if it is affected.\n\nWhat it is: CVE-2026-63895 is a vulnerability in Linux, published on 19 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-63895 in the wild and no public exploit code.\n\nAffected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-63895/ (Markdown: https://insights.sbomify.com/CVE-2026-63895/index.md)","id":"CVE-2026-63895","markdown":"https://insights.sbomify.com/CVE-2026-63895/index.md","name":"CVE-2026-63895","record":{"aliases":["BELL-CVE-2026-63895","DEBIAN-CVE-2026-63895","GHSA-hqp4-gw43-6pcc","ROOT-OS-DEBIAN-11-CVE-2026-63895","ROOT-OS-UBUNTU-2204-CVE-2026-63895","UBUNTU-CVE-2026-63895"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["data_read"],"network_reachable":"adjacent_or_local","non_default_config":true,"product_category":"Linux kernel USB gadget","requires_auth":"high_privilege","summary":"A privileged local attacker can read uninitialized kernel memory via a short USB control transfer in the Linux kernel's FunctionFS driver.","user_interaction":"not_required","vuln_class":"information_disclosure"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: f_fs: copy only received bytes on short ep0 read\n\nffs_ep0_read() allocates its control-OUT data buffer with\nkmalloc() (not kzalloc) at the Length value from the Setup\npacket, then copies that full len to userspace regardless of\nhow many bytes were actually received:\n\n    data = kmalloc(len, GFP_KERNEL);\n    ...\n    ret = __ffs_ep0_queue_wait(ffs, data, len);\n    if ((ret \u003e 0) \u0026\u0026 (copy_to_user(buf, data, len)))\n            ret = -EFAULT;\n\n__ffs_ep0_queue_wait() returns req-\u003eactual, which on a short\ncontrol OUT transfer is strictly less than len.  The\ncopy_to_user() call still copies len bytes, so on a short OUT\nthe last (len - ret) bytes of the kmalloc() buffer --\nuninitialised slab residue -- are delivered to the FunctionFS\ndaemon.\n\nShort ep0 OUT completions are specified USB control-transfer\nbehavior and are produced by in-tree UDCs:\n\n  * dwc2 continues on req-\u003eactual \u003c req-\u003elength for ep0 DATA OUT\n    (short-not-ok is the only ep0-OUT stall path).\n  * aspeed_udc ends ep0 OUT on rx_len \u003c ep-\u003eep.maxpacket.\n  * renesas_usbf logs \"ep0 short packet\" and completes the\n    request.\n  * dwc3 stalls on short IN but not on short OUT.\n\nA short ep0 OUT is therefore not evidence of a broken UDC; it is\na normal condition f_fs has to cope with.  The sibling gadgetfs\nimplementation in drivers/usb/gadget/legacy/inode.c already does\nthis correctly via min(len, dev-\u003ereq-\u003eactual) before\ncopy_to_user().  This patch brings f_fs.c to the same safe\npattern rather than trimming at a defensive layer.\n\nThe bug is reached from the FunctionFS device node, which in\nreal deployments is owned by the privileged gadget daemon\n(adbd, UMS, composite gadget services, etc.); it is not\nreachable from unprivileged userspace.  Linux host stacks\nnormally reject short-wLength control OUTs before they reach\nthe gadget, so reproducing this required a build that\nbypasses that host-side check.  With the bypass in place, a\n1-byte payload on a 64-byte Setup produces 63 bytes of\nnon-canary slab residue in the daemon's read buffer.\n\nFix by copying only ret (actually received) bytes to\nuserspace.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"usb: gadget: f_fs: copy only received bytes on short ep0 read","id":"CVE-2026-63895","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"information_disclosure","year":"2026"},"n_packages":0,"n_references":7,"next":{"headline":"usb: gadget: composite: fix integer underflow in WebUSB GET_URL handling","id":"CVE-2026-63896"},"packages":[],"prev":{"headline":"usb: gadget: f_fs: serialize DMABUF cancel against request completion","id":"CVE-2026-63894"},"products":["Linux"],"published":"2026-07-19","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-07-19","vendors":["Linux"]},"summary":"A privileged local attacker can read uninitialized kernel memory via a short USB control transfer in the Linux kernel's FunctionFS driver.","url":"https://insights.sbomify.com/CVE-2026-63895/"}