The Linux kernel's USB gadget composite driver had an integer underflow vulnerability in the WebUSB GET_URL handler within composite_setup(). When the host-supplied wLength is smaller than WEBUSB_URL_DESCRIPTOR_HEADER_LENGTH, subtracting this constant from wLength causes an unsigned integer wraparound. This leads to a memcpy operation copying nearly UINT_MAX bytes from the landing_page buffer into the request buffer, causing out-of-bounds memory access. The vulnerability can be triggered by a single SETUP packet from a USB host targeting any gadget with webusb/use=1 and a configured landingPage. The fix ensures that if wLength is smaller than the header length, landing_page_length is set to landing_page_offset, making the memcpy a no-op and preventing memory corruption.

This vulnerability allows a USB host to cause an out-of-bounds memory copy in the kernel's USB gadget driver, potentially leading to memory corruption. Such corruption could result in system instability, crashes, or other undefined behavior. There is no evidence of known exploits in the wild. The impact is limited to systems running vulnerable Linux kernel versions with USB gadgets configured with webusb/use=1 and a landingPage.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability description indicates that a fix has been implemented in the Linux kernel source code by handling the small wLength case before performing arithmetic to prevent integer underflow. Users should monitor official Linux kernel advisories and apply updates when available. In the meantime, disabling or avoiding use of USB gadgets with webusb/use=1 and landingPage configured may reduce exposure.