usb: gadget: configfs: Fix OOB read on empty string write

Summary

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: configfs: Fix OOB read on empty string write When writing an empty string to either 'qw_sign' or 'landingPage' sysfs attributes, the store functions attempt to access page[l - 1] before validating that the length 'l' is greater than zero. This patch fixes the vulnerability by adding a check at the beginning of os_desc_qw_sign_store() and webusb_landingPage_store() to handle the zero-length input case gracefully by returning immediately.

Timeline

1. Jul 28, 2025, 11:22 AM UTCCVE published
2. May 11, 2026, 9:29 PM UTCRecord last updated

Affected versions

• Linux Linux

  Version range not reported

• Linux Linux

  3.16

References 8