The Linux kernel's usb gadget function f_fs had a flaw in ffs_ep0_read() where it allocated a buffer sized by the Setup packet length and copied that full length to userspace even if fewer bytes were received on a short ep0 OUT transfer. This caused uninitialized slab memory to leak to the FunctionFS daemon, which runs with privileges. The vulnerability is triggered by short control OUT transfers, which are normal USB behavior but typically blocked by host stacks. The patch corrects this by copying only the actual received bytes, aligning with the behavior of the sibling gadgetfs implementation. The flaw is limited to privileged daemon access and requires a host-side check bypass to exploit.

The vulnerability can leak uninitialized kernel memory contents to the privileged FunctionFS daemon via short USB control OUT transfers. This could expose sensitive kernel memory data to the daemon process. However, it is not exploitable by unprivileged userspace and requires a host stack bypass to trigger. No direct remote code execution or privilege escalation is described.

A fix is available in the Linux kernel that changes the copy_to_user() call to copy only the actual received bytes rather than the full requested length. Users should apply the official kernel patch that implements this correction. Since the issue affects privileged FunctionFS daemons, restricting access to these daemons and ensuring host USB stacks enforce short packet checks can reduce risk until patched.