{"id":25979,"date":"2026-09-18T04:32:10","date_gmt":"2026-09-17T20:32:10","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-93122"},"modified":"2026-09-18T04:32:10","modified_gmt":"2026-09-17T20:32:10","slug":"cve-2026-93122","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-93122","title":{"rendered":"CVE-2026-93122 &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: uac: val"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>usb: gadget: uac: validate rate list length before storing<\/p>\n<p>UAC1 and UAC2 configfs rate-list attributes parse a comma-separated<br \/>\nlist of sampling rates and store each parsed value in fixed-size arrays.<br \/>\nThe arrays have UAC_MAX_RATES entries, but the store paths do not check<br \/>\nthat the input contains at most that many tokens before writing through<br \/>\nopts-&gt;name##s[i++].<\/p>\n<p>Writing more than ten rates therefore writes past the end of the<br \/>\np_srates[] or c_srates[] array in struct f_uac1_opts or struct<br \/>\nf_uac2_opts.<\/p>\n<p>With CONFIG_UBSAN_BOUNDS enabled, writing an 11-entry rate list to the<br \/>\nUAC1 p_srate attribute reports:<\/p>\n<p>  UBSAN: array-index-out-of-bounds<br \/>\n  drivers\/usb\/gadget\/function\/f_uac1.c:1669:1<br \/>\n  index 10 is out of range for type &#8216;int [10]&#8217;<br \/>\n  __ubsan_handle_out_of_bounds.cold<br \/>\n  f_uac1_opts_p_srate_store<br \/>\n  configfs_write_iter<br \/>\n  vfs_write<br \/>\n  ksys_write<br \/>\n  do_syscall_64<\/p>\n<p>The same reproducer against the UAC2 p_srate attribute reports:<\/p>\n<p>  UBSAN: array-index-out-of-bounds<br \/>\n  drivers\/usb\/gadget\/function\/f_uac2.c:2087:1<br \/>\n  index 10 is out of range for type &#8216;int [10]&#8217;<br \/>\n  __ubsan_handle_out_of_bounds.cold<br \/>\n  f_uac2_opts_p_srate_store<br \/>\n  configfs_write_iter<br \/>\n  vfs_write<br \/>\n  ksys_write<br \/>\n  do_syscall_64<\/p>\n<p>Reject additional tokens once UAC_MAX_RATES entries have been parsed.<br \/>\nAlso keep the original kstrdup() pointer for kfree(), because strsep()<br \/>\nadvances the parsing cursor. Freeing the advanced cursor leaks the<br \/>\noriginal buffer on successful parses and can free an interior pointer on<br \/>\nsome error paths.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>usb: gadget: uac: validate rate list length before storing<\/p>\n<p>UAC1 and UAC2 configfs rate-list attributes parse a comma-separated<br \/>\nlis<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-25979","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/25979","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=25979"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=25979"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=25979"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}