Null Pointer Dereference in Linux Kernel USB Gadget's Mass Storage Driver

CVE-2026-90023

What is CVE-2026-90023?

In the Linux Kernel, a vulnerability in the USB gadget mass storage driver can lead to a null pointer dereference when the number of buffers is inaccurately set to less than 2. This situation arises due to improper validation of input values, where a value of 0 or 1 bypasses existing restrictions and results in an erroneous state. The issue has been rectified by implementing a check to ensure that the number of buffers must be at least 2, returning -EINVAL for invalid configurations. This enhancement aligns the driver’s behavior with the defined Kconfig settings.

References