In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_fs: Fix NULL pointer dereference in FUNCTIONFS_ENDPOINT_DESC When… (CVE-2026-98764)

The vulnerability in the Linux kernel's usb gadget FunctionFS (f_fs) subsystem arises when user space configures FunctionFS with only full-speed descriptors (FUNCTIONFS_HAS_FS_DESC) but the gadget operates at a higher speed such as USB_SPEED_HIGH or USB_SPEED_SUPER. The kernel's config_ep_by_speed() function falls back to full-speed descriptors when higher speed descriptors are absent, enabling the endpoint successfully. However, when the FUNCTIONFS_ENDPOINT_DESC ioctl is issued, ffs_epfile_ioctl() selects the descriptor index based solely on the gadget's current speed without fallback. This leads to dereferencing a NULL pointer when accessing desc->bLength because the higher speed descriptor is missing. The patch fixes this by implementing fallback through lower speed descriptors and safely returning -EINVAL if no valid descriptor is found, preventing kernel NULL pointer dereference panics.

The vulnerability causes a kernel NULL pointer dereference panic, resulting in a denial of service condition on affected Linux systems using the usb gadget FunctionFS with incomplete descriptors. There is no indication of privilege escalation or data corruption beyond the kernel panic.

A fix has been implemented in the Linux kernel to address this issue by adding fallback logic for descriptor selection and safe error handling. Users should update to the fixed kernel version once available. No additional mitigation is indicated in the advisory.