In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_fs: Initialize epfile->in early to fix endpoint direction checks… (CVE-2026-64327)
A vulnerability in the Linux kernel's USB gadget function filesystem (FunctionFS) was resolved by initializing the endpoint file's direction flag earlier. Previously, the endpoint direction flag (epfile->in) was only set after USB host connection, causing early userspace ioctls to misinterpret DMA directions. This fix ensures correct endpoint direction checks before the host connects, preventing incorrect DMA operations.
AI Analysis
Technical Summary
The Linux kernel's USB gadget FunctionFS had a flaw where the epfile->in field, indicating endpoint direction, was initialized too late—only during USB host connection in ffs_func_eps_enable(). Early userspace ioctls such as FUNCTIONFS_DMABUF_ATTACH that run before host connection saw epfile->in as zero, leading to incorrect DMA direction handling. The fix moves epfile->in initialization to ffs_epfiles_create(), ensuring accurate endpoint direction information is available before userspace opens endpoint files.
Potential Impact
Incorrect DMA direction settings could lead to improper data handling in USB gadget endpoints during early userspace operations before USB host connection. This may cause functional issues or data corruption in affected USB gadget interactions. There is no indication of remote code execution or privilege escalation from the provided data.
Mitigation Recommendations
A fix has been implemented in the Linux kernel to initialize epfile->in earlier in the USB gadget FunctionFS code. Users should update to the kernel version that includes this fix once available. Patch status is not yet confirmed in the provided data; check the official Linux kernel advisories or vendor updates for the exact fixed version and apply the update accordingly.
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_fs: Initialize epfile->in early to fix endpoint direction checks… (CVE-2026-64327)
Description
A vulnerability in the Linux kernel's USB gadget function filesystem (FunctionFS) was resolved by initializing the endpoint file's direction flag earlier. Previously, the endpoint direction flag (epfile->in) was only set after USB host connection, causing early userspace ioctls to misinterpret DMA directions. This fix ensures correct endpoint direction checks before the host connects, preventing incorrect DMA operations.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Linux kernel's USB gadget FunctionFS had a flaw where the epfile->in field, indicating endpoint direction, was initialized too late—only during USB host connection in ffs_func_eps_enable(). Early userspace ioctls such as FUNCTIONFS_DMABUF_ATTACH that run before host connection saw epfile->in as zero, leading to incorrect DMA direction handling. The fix moves epfile->in initialization to ffs_epfiles_create(), ensuring accurate endpoint direction information is available before userspace opens endpoint files.
Potential Impact
Incorrect DMA direction settings could lead to improper data handling in USB gadget endpoints during early userspace operations before USB host connection. This may cause functional issues or data corruption in affected USB gadget interactions. There is no indication of remote code execution or privilege escalation from the provided data.
Mitigation Recommendations
A fix has been implemented in the Linux kernel to initialize epfile->in earlier in the USB gadget FunctionFS code. Users should update to the kernel version that includes this fix once available. Patch status is not yet confirmed in the provided data; check the official Linux kernel advisories or vendor updates for the exact fixed version and apply the update accordingly.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-gjhh-5f46-ffh6
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-64327"]
- Ecosystems
- []
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a65420d9c2644c7f80859cf
Added to database: 07/25/2026, 23:09:01 UTC
Last enriched: 07/25/2026, 23:35:14 UTC
Last updated: 07/26/2026, 03:47:36 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.