CVE-2026-93056

CVE-2026-93056

published September 17, 2026

CVSS
—
EPSS
0%
Percentile
6.8
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: f_uac1_legacy: remove broken string configfs attributes

The UAC1_STR_ATTRIBUTE macro defines configfs show/store handlers for

the fn_play, fn_cap, and fn_cntl string options. The store function

contains an inverted null check on the kstrndup() return value.

This means every write attempt returns -ENOMEM on success and

dereferences a NULL pointer on allocation failure. The attributes

have been broken and unused for many years.

Remove the UAC1_STR_ATTRIBUTE macro and the three attributes it

generated. The internal defaults (FILE_PCM_PLAYBACK, FILE_PCM_CAPTURE,

FILE_CONTROL) set in f_audio_alloc_inst() are unaffected.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00176 · 6.8th percentile
Published
2026-09-17T21:17Z
References (8)
EPSS history
Timeline
  • 19 SEP 03:55Z
    EPSS moved — → 0%
    epss
  • 17 SEP 16:10Z
    usb: gadget: f_uac1_legacy: remove broken string configfs attributes
    cvelistv5