CVE-2026-93120 usb: gadget: configfs: fix out-of-bounds read of qw_sign
A local attacker with access to configfs can read kernel memory beyond the USB gadget signature buffer, potentially exposing sensitive data.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-93120?
CVE-2026-93120 is a vulnerability in Linux, published on 17 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: configfs: fix out-of-bounds read of qw_sign
os_desc_qw_sign_show() passes OS_STRING_QW_SIGN_LEN as the input length to utf16s_to_utf8s(), but that argument counts UTF-16 code units while OS_STRING_QW_SIGN_LEN (14) is the byte size of qw_sign[]. The array holds only OS_STRING_QW_SIGN_LEN / 2 (7) code units, so the conversion reads up to 7 units (14 bytes) past the end of qw_sign[] into the following members of struct gadget_info when the stored signature fills the array without a NUL terminator, exposing those bytes through the configfs attribute.
The store path halves the count for its input bound but passes the full byte count as the utf8s_to_utf16s() output limit; use the destination code-unit count in both directions.
Which versions are affected by CVE-2026-93120?
How do I fix CVE-2026-93120?
Apply the vendor's patch.
Is CVE-2026-93120 being exploited?
There is no known exploitation of CVE-2026-93120 in the wild and no public exploit code.
Sources
Also known as AZL-102551, BELL-CVE-2026-93120, DEBIAN-CVE-2026-93120, GHSA-pg5h-3pm6-795f, UBUNTU-CVE-2026-93120.