VulnerabilityPublished 16 Sep 2026Updated 30 Oct 2026

CVE-2026-90023: Linux kernel · usb: gadget: f_mass_storage: fix null pointer dereference in

Source GCVE Database

Compare

Authoritative record:CVE-2026-90023· Medium

Not known to be exploited · fixed in f4f0fe3ab47ed57ee4974fdd3e9dccb7839a7ebf : update Linux kernel when convenient.

Data as of 30 Oct 2026, 19:20 UTC

Severity

Medium

Rated Medium by Threat Radar's AI analysis · CVSS not yet scored by NVD

Thin evidence

One scorer or none

Patch: Available – fixed in f4f0fe3ab47ed57ee4974fdd3e9dccb7839a7ebf, e54820b9dc1d6d731ecc3e51462445dc952906a7, b9b5b5df5b8dd3c1572ed267200276a44cc67d8e +5

Exploitation evidence

Disclosed: evidence found.
CVE published 16 Sep 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 30 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

ghsa-4pqp-h39m-gcw4

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ fe5a6c48fd954489f51aab151d5dad9254c76419, < f4f0fe3ab47ed57ee4974fdd3e9dccb7839a7ebf	Fixed in f4f0fe3ab47ed57ee4974fdd3e9dccb7839a7ebf
LinuxLinux	Affected ≥ fe5a6c48fd954489f51aab151d5dad9254c76419, < e54820b9dc1d6d731ecc3e51462445dc952906a7	Fixed in e54820b9dc1d6d731ecc3e51462445dc952906a7
LinuxLinux	Affected ≥ fe5a6c48fd954489f51aab151d5dad9254c76419, < b9b5b5df5b8dd3c1572ed267200276a44cc67d8e	Fixed in b9b5b5df5b8dd3c1572ed267200276a44cc67d8e
LinuxLinux	Affected ≥ fe5a6c48fd954489f51aab151d5dad9254c76419, < 51cc9af4f2d3f0b765266aced66b9b532b423b13	Fixed in 51cc9af4f2d3f0b765266aced66b9b532b423b13
LinuxLinux	Affected ≥ fe5a6c48fd954489f51aab151d5dad9254c76419, < 38edd187a37db0d8e4bf84cc954dbdbe7bfa366f	Fixed in 38edd187a37db0d8e4bf84cc954dbdbe7bfa366f
LinuxLinux	Affected ≥ fe5a6c48fd954489f51aab151d5dad9254c76419, < 9e8dd2a7a8ccbb756771ad985b0ad3387ed3c957	Fixed in 9e8dd2a7a8ccbb756771ad985b0ad3387ed3c957

AI-suggested

A fix has been applied to the Linux kernel source code to add validation for the buffer count parameter, rejecting values less than 2. Users should update their Linux kernel to a version that includes this fix once available. No other mitigations are specified.

Description

A null pointer dereference vulnerability was fixed in the Linux kernel's USB gadget mass storage function (f_mass_storage). The issue arose because input validation for the number of buffers (n) was bypassed, allowing values 0 or 1, which led to a null pointer dereference. The fix adds a check to reject n values less than 2, consistent with kernel configuration limits.

Impact

This vulnerability can cause a null pointer dereference in the kernel, potentially leading to a denial of service (system crash) when the USB gadget mass storage function processes invalid buffer counts. There is no indication of privilege escalation or code execution from the provided data.

Summary

The Linux kernel's USB gadget mass storage function (f_mass_storage) contained a vulnerability where the removal of the fsg_num_buffers_validate() function allowed bypassing of buffer count restrictions. Specifically, the kstrtou8() function could interpret the buffer count (n) as 0 or 1, which is invalid and leads to a null pointer dereference in fsg_common_set_num_buffers(). The patch adds a validation step to return an error (-EINVAL) if n is less than 2, aligning with Kconfig settings that restrict n to a minimum of 2.

References

Community reviews

Loading reviews…