The Linux kernel USB gadget composite driver had a vulnerability where the OTG branch of composite_setup() used list_first_entry() to get the first configuration entry without properly checking if the list was empty. Since list_first_entry() never returns NULL, the subsequent check for a NULL configuration was ineffective, leading to potential reading and copying of invalid memory from config->descriptors[0]. This occurs when cdev->configs is empty, such as during a teardown race with a control transfer in flight or when a driver sets is_otg before adding a configuration. The issue was fixed by changing to list_first_entry_or_null(), enabling the NULL check to function correctly and preventing invalid memory access.

The vulnerability can cause the kernel to read and copy invalid memory during USB control transfers, potentially leading to kernel memory corruption or faults such as KASAN errors. This may result in system instability or crashes. There is no indication of remote code execution or privilege escalation from the provided data.

A fix is available in the Linux kernel that replaces list_first_entry() with list_first_entry_or_null() in the USB_DT_OTG handler to properly handle empty configuration lists. Users should apply the official kernel update or patch that includes this fix. Since this is a kernel-level issue, updating to the patched kernel version is the recommended remediation.