CVE-2025-38497

Description

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: configfs: Fix OOB read on empty string write When writing an empty string to either 'qw_sign' or 'landingPage' sysfs attributes, the store functions attempt to access page[l - 1] before validating that the length 'l' is greater than zero. This patch fixes the vulnerability by adding a check at the beginning of os_desc_qw_sign_store() and webusb_landingPage_store() to handle the zero-length input case gracefully by returning immediately.

Reserved 2025-04-16 | Published 2025-07-28 | Updated 2025-07-28 | Assigner Linux

Product status

Default status
unaffected

1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 2798111f8e504ac747cce911226135d50b8de468
affected

1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 58bdd5160184645771553ea732da5c2887fc9bd1
affected

1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 783ea37b237a9b524f1e5ca018ea17d772ee0ea0
affected

1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 22b7897c289cc25d99c603f5144096142a30d897
affected

1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 3014168731b7930300aab656085af784edc861f6
affected

Default status
affected

6.1.147
unaffected

6.6.100
unaffected

6.12.40
unaffected

6.15.8
unaffected

6.16
unaffected

References

git.kernel.org/...c/2798111f8e504ac747cce911226135d50b8de468

git.kernel.org/...c/58bdd5160184645771553ea732da5c2887fc9bd1

git.kernel.org/...c/783ea37b237a9b524f1e5ca018ea17d772ee0ea0

git.kernel.org/...c/22b7897c289cc25d99c603f5144096142a30d897

git.kernel.org/...c/3014168731b7930300aab656085af784edc861f6

cve.org (CVE-2025-38497)

nvd.nist.gov (CVE-2025-38497)

Download JSON